14 giugno 2004 alle 23:57:18

The threats of cross-site scripting
Cross-site scripting poses server application risks that include, but are not limited to, the following:

Users can unknowingly execute malicious scripts when viewing dynamically generated pages based on content provided by an attacker.
An attacker can take over the user session before the user's session cookie expires.
An attacker can connect users to a malicious server of the attacker's choice.
An attacker who can convince a user to access a URL supplied by the attacker could cause script or HTML of the attacker's choice to be executed in the user's browser. Using this technique, an attacker can take actions with the privileges of the user who accessed the URL, such as issuing queries on the underlying SQL databases and viewing the results and to exploit the known faulty implementations on the target system.