15

Is it possible to perform an SQL injection inside an XSS attack? And if so, where can I find information on this or some examples?

Improve this question

1 Answer 1

Reset to default
40

That depends on what you mean by "inside". For example, as Conor Mancone suggested, there could be a combined reflected XSS and SQL injection. That could look like this:

http://example.com/badendpoint?q=<script>$('input').value="';DELETE FROM USERS;--";$('form').submit()</script>

In this example, the SQL injection is the payload of the XSS. That's sort of putting the SQL injection "inside" the XSS.

When a hapless user opens that link, the script tags will get added to the page. The JavaScript will then fill out a form and submit it. The data entered in the form contains the SQL injection that deletes all users from the target database.

As nobody said, it may be better to call this chaining the vulnerabilities together.

Improve this answer
2
  • 7
    I think this is the more insightful answer. It's also absolutely conceivable that an SQLi needs XSS to be practical. Say, the SQLi only fires in an admin backend form submission, and you use XSS against an admin user to trigger the submission.
    – Arminius
    Mar 4, 2021 at 4:51
  • That would be a terrible endpoint indeed. Vulnerable to XSS and SQL injection and using plain HTTP!
    – Brian Drake
    Mar 6, 2021 at 8:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .