Other nomination

Client-side SQL Injection Attacks

pdp

Google Gears puts a SQLite relational store in the browser, so unsanitised input in client-side queries makes SQL injection a client-side problem: attackers can dump, alter or destroy local tables, and echo injected HTML back to cause persistent XSS that recurs on every load. pdp also flags the Gears WorkerPool as cover for background intranet scanning and crypto work.

Record

Researcher

pdp

In the archive

• Nominated for the 2007 Top 10 Web Hacking Techniques

Tags

• sqli
• database
• injection
• xss
• javascript
• abuse-of-functionality
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of pdp, first published at the original source. Preserved copies are kept so the citation survives its host.