My application has an Upload Management Module and accepts Excel and text files to our server.

I detected invalid data inside some uploaded files (the uploader put <script>alert("XSS")</script> instead of the original data). I verified inside the database and that data was stored inside it.

I would like to know if my application is vulnerable.

3 Answers 3


We can't tell if it's vulnerable or not.

In protecting against stored XSS attacks (although the same applies to reflected attacks) there are 2 key stages where protection should be applied. When the data is presented to your system and when you present the data to other systems. If you know that you have protection in place which should reject pontential XSS attacks at upload, then it appears to be failing. If you have protection on the output channels then it's possible that this is not exploitable. But we don't know which of these you have in place.

You would need to look at how this data leaves your system to establish if this potential vulnerabilitiy can be exploited.


A good practice to handle user upload has been shared in this post on the google security blog: It explains common pitfalls and some additional defense steps. Let me summarize here:

Encode your output for its context: Make sure you have proper output encoding with different algorithm for the context. You should have different sanitization practices for each HTML, HTML attributes, JSON etc.

Serve user content from a different domain: First of all, it's always wise to serve user content from a different domain. Google uses googleusercontent.com and you will surely find it a cheap investment in your security. The Same Origin Policy helps you here, since an XSS one the less-important domain cannot reach over to your main domain.


If user was able to upload malicious string in file or instead of file: it is vulnerable.

You have to have validation (especially on server side) to be sure which data you upload to your DB. In general, you should validate and sanitize every data input.

Read more about XSS prevention and about OWASP Enterprise Security API, which is available for Java, PHP and other popular web-application platform.

  • 2
    Not necessarily. Stack Exchange allows me to enter a post containing <script>alert("XSS")</script> (like this), however it is not vulnerable. It is all to do with how it is output. Jan 10, 2014 at 19:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .