14

Is it possible to perform an SQL injection inside an XSS attack? And if so, where can I find information on this or some examples?

1 Answer 1

39

That depends on what you mean by "inside". For example, as Conor Mancone suggested, there could be a combined reflected XSS and SQL injection. That could look like this:

http://example.com/badendpoint?q=<script>$('input').value="';DELETE FROM USERS;--";$('form').submit()</script>

In this example, the SQL injection is the payload of the XSS. That's sort of putting the SQL injection "inside" the XSS.

When a hapless user opens that link, the script tags will get added to the page. The JavaScript will then fill out a form and submit it. The data entered in the form contains the SQL injection that deletes all users from the target database.

As nobody said, it may be better to call this chaining the vulnerabilities together.

2
  • 7
    I think this is the more insightful answer. It's also absolutely conceivable that an SQLi needs XSS to be practical. Say, the SQLi only fires in an admin backend form submission, and you use XSS against an admin user to trigger the submission.
    – Arminius
    Mar 4, 2021 at 4:51
  • That would be a terrible endpoint indeed. Vulnerable to XSS and SQL injection and using plain HTTP! Mar 6, 2021 at 8:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.