Fixing Stored Cross-Site Scripting (Stored XSS)
Vulnerability assessment details, CWE reference metrics, and complete code-level patches.
Threat Profile
Vulnerability Analysis
Stored Cross-Site Scripting occurs when an application stores unvalidated or unsanitized user inputs (such as comments, profile parameters, or message bodies) on its database or files. When other users visit the page containing this data, the browser executes the stored script context.
How it is Detected
Detected by submitting standard script tags or image error payloads, checking if they are rendered in subsequent resource views without html-escaping.
Remediation Guidelines
Html-escape all dynamic data before rendering it in the DOM. Implement a strict Content Security Policy (CSP) to block inline scripts and unauthorized external domains.
Remediation Script (HTML / Javascript (escaping))
<!-- SECURE REMEDIATION: Escaping outputs in HTML -->
<div>
<?php echo htmlspecialchars($userComment, ENT_QUOTES, 'UTF-8'); ?>
</div>Frequently Asked Questions
Why is Stored XSS particularly dangerous?
Unlike Reflected XSS, Stored XSS executes automatically for any user who views the infected page, making it highly effective for session hijacking.
How can I block Stored XSS via headers?
Deploy a Content Security Policy (CSP) header prohibiting 'unsafe-inline' scripts and strictly whitelist trusted script hosts.
What is the difference between XSS and CSRF?
XSS executes scripts inside the victim's browser context to steal tokens or run commands, while CSRF triggers unauthorized requests from the victim's session to a target server.
Related Vulnerability Profiles
SQL Injection (SQLi)
Attackers execute arbitrary SQL commands, bypassing authentication and manipulating database schemas.
Reflected Cross-Site Scripting (Reflected XSS)
Malicious scripts are reflected off the web server (e.g. search queries) and executed immediately in the user's browser.
DOM-based Cross-Site Scripting (DOM XSS)
Vulnerability where the client-side JavaScript processes inputs in an unsafe way (e.g. using eval or innerHTML).
Cross-Site Request Forgery (CSRF)
Attackers force authenticated users to execute unauthorized actions on a web application where they are logged in.