I wanna know that weather a site having XSS vulnerability can lead the hacker to access database? I know that he can get the username and password from the cookie stored but can he completely access the database?

4 Answers 4


XSS doesn't compromise the server, it compromises the client.

Basically, if your site is vulnerable to an XSS attack, then you're serving dodgy code to your users. The attack has control over your users' actions, so has access to anything your users do.

So if your users do not normally have complete access to your DB, then an XSS won't give an attacker that access.

However, do bear in mind that "users" includes "admins", so the attacker has the power of an admin if one logs in while the exploit is active.

  • You mean i can't add sql query to any field/form and fetch data from databse?
    – v0ld3m0rt
    Commented Oct 21, 2013 at 11:47
  • Also: I'm assuming that your API has no "hidden functionality" - e.g. secret endpoints that the server supports but the client doesn't present as an option. If you have any of those, then you've got bigger problems.
    – cloudfeet
    Commented Oct 21, 2013 at 11:47
  • @v0ld3m0rt - no, that is a different attack, called "SQL Injection".
    – cloudfeet
    Commented Oct 21, 2013 at 11:47
  • than what's the difference between the two? Only that sqli happens at database level and XSS with user level?
    – v0ld3m0rt
    Commented Oct 21, 2013 at 11:49
  • XSS is basically like casting a magic spell and turning all of your users evil at once. So if your database is safe against evil users, then it's safe against XSS. Your users, however, will still be involuntarily turned evil, which is still a massive problem.
    – cloudfeet
    Commented Oct 21, 2013 at 11:50

No, with two caveats:

  1. There isn't really any detail in your question, so it's very hard to be definitive.
  2. An attacker may use XSS as part of a broader attack. If she can get the admin to run something on his machine via XSS, who knows where that could lead...
  • By "admin to run" you mean getting administrative privileges by cookie hacking?
    – v0ld3m0rt
    Commented Oct 21, 2013 at 11:40
  • I mean more generally that if you can use XSS to run something in the browser on the administrators machine, it invokes Immutable Law #1: If a bad guy can persuade you to run his program on your computer, it's not solely your computer anymore. See Abe's reply below for an example. Commented Oct 22, 2013 at 10:19

As cloudfeet mentions XSS compromises the client not the server, so an XSS vulnerability will not give you direct access to the database.

That said, in the past (while doing a requested vulnerability assessment of a site), I was able to use an XSS vulnerability to steal the session of an administrative user. This gave me access to an entire administrative section of the site that was not visible to the average user. This section allowed modification of every table in the database (excluding system tables) through administrative pages.

I have found that administrative sections of sites will sometimes cut security corners because admins are trusted users. This could mean there are SQL Injection vulnerabilities. If this is the case then you can directly access the database.

In summary - no, an XSS vulnerability will not give you direct database access. But in very specific situations it can lead to expanded database access.


If you have an XSS vulnerability, the attacker can do anything that your web UI can do and access anything your web UI can access. If your web UI and supporting API is constructed in such a way that it grants direct db access, then yes, the attacker would have such access. If your application offers no opportunity through the web UI and supporting API to eventually execute SQL then XSS will not grant such functionality.

Keep in mind that anything in your UI could be leveraged to get this access, including but not limited to:

  • an intentionally implemented feature that lets the user write sql queries
  • a feature that lets the user change the administrative password and enable remote login (which grants system access at the application's level making it only a matter of time before the attacker figures out how the system connects to the database)
  • a sql injection vulnerability accessible through the UI
  • an API feature accessible to the web ui, but unused by the web ui
  • It's not actually just your "web UI" - it's your web API. I've seen web apps where the API could theoretically do something, but the HTML+JavaScript client didn't allow it (this is a terrible idea). XSS code can access the API using your credentials, so (in that thankfully rare) case more dangerous than an evil user using the intended UI.
    – cloudfeet
    Commented Dec 18, 2013 at 17:34
  • @cloudfeet: interesting how you interpret my words. When I say 'anything your web ui can do', one of the things your UI can do is access your web API. But I do see how that wasn't completely clear and will update my answer to be a little more explicit.
    – atk
    Commented Dec 18, 2013 at 20:59
  • Yeah - I'm aware I was kinda misinterpreting you. :p It was just that I've encountered code from people who didn't understand that subtlety (so put security policy in the client), so I thought your answer would be even better with clarification. :)
    – cloudfeet
    Commented Dec 18, 2013 at 22:36
  • @cloudfeet: I'm all for clarity. I've seen plenty of both intentional and unintentional misinterpretations, so I find it better to err on the side of clarity.
    – atk
    Commented Dec 18, 2013 at 23:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .