A lot of articles underline that XSS vulnerabilities can be very dangerous for the website on which they exist. I wonder how much is this true when we find these XSS vulnerabilities on the frontend of a website, in fields such as the search forms?

  • 2
    Read about the Apache foundation XSS story. You will be amazed :)
    – AK_
    Commented Jun 9, 2014 at 11:13

1 Answer 1


Cross-site scripting vulnerabilities are extremely dangerous, because they allow the attacker to control the victim's browser to some extend.

This can be used for all kinds of malicious actions:

  • stealing sensitive cookies or reading personal pages (the user account, private messages etc.)
  • making requests on the victim's behalf (e. g., ordering products via the victim's account and sending them to an arbitrary address)
  • exploting the trust of the victim in the site; for example, an attacker might render a fake login form and prompt the user to enter the password. Or they might trick the user into downloading a malicious file which looks like it's served by the site.
  • attacking the server through a privileged account

So while XSS may look less dangerous than, say, SQL injections at first site, it's actually a major threat for both your users and your server.

  • Don’t forget IE’s capability to execute arbitrary ActiveX controls on trusted sites which can result in execution of arbitrary commands on the victim’s machine.
    – Gumbo
    Commented Jun 9, 2014 at 10:58
  • @Gumbo Can you explain that a bit more? I didn't know that yet and have not read of it.
    – Xatenev
    Commented Jun 9, 2014 at 12:26
  • @Xatenev new ActiveXObject("WScript.Shell").run("calc")
    – Gumbo
    Commented Jun 9, 2014 at 12:33
  • @Gumbo Oh haha, that works? n1 to know, thnaks
    – Xatenev
    Commented Jun 9, 2014 at 12:33
  • @Xatenev This works only on sites which are configured as trusted sites.
    – Gumbo
    Commented Jun 9, 2014 at 12:36

You must log in to answer this question.