I wanna know that weather a site having XSS vulnerability can lead the hacker to access database? I know that he can get the username and password from the cookie stored but can he completely access the database?
XSS doesn't compromise the server, it compromises the client.
Basically, if your site is vulnerable to an XSS attack, then you're serving dodgy code to your users. The attack has control over your users' actions, so has access to anything your users do.
So if your users do not normally have complete access to your DB, then an XSS won't give an attacker that access.
However, do bear in mind that "users" includes "admins", so the attacker has the power of an admin if one logs in while the exploit is active.
As cloudfeet mentions XSS compromises the client not the server, so an XSS vulnerability will not give you direct access to the database.
That said, in the past (while doing a requested vulnerability assessment of a site), I was able to use an XSS vulnerability to steal the session of an administrative user. This gave me access to an entire administrative section of the site that was not visible to the average user. This section allowed modification of every table in the database (excluding system tables) through administrative pages.
I have found that administrative sections of sites will sometimes cut security corners because admins are trusted users. This could mean there are SQL Injection vulnerabilities. If this is the case then you can directly access the database.
In summary - no, an XSS vulnerability will not give you direct database access. But in very specific situations it can lead to expanded database access.
If you have an XSS vulnerability, the attacker can do anything that your web UI can do and access anything your web UI can access. If your web UI and supporting API is constructed in such a way that it grants direct db access, then yes, the attacker would have such access. If your application offers no opportunity through the web UI and supporting API to eventually execute SQL then XSS will not grant such functionality.
Keep in mind that anything in your UI could be leveraged to get this access, including but not limited to:
- an intentionally implemented feature that lets the user write sql queries
- a feature that lets the user change the administrative password and enable remote login (which grants system access at the application's level making it only a matter of time before the attacker figures out how the system connects to the database)
- a sql injection vulnerability accessible through the UI
- an API feature accessible to the web ui, but unused by the web ui