Client-side SQL injection (DOM-based)
Summary: Client-side SQL injection is a DOM-based vulnerability that arises when a script incorporates controllable data, such as data from the URL, into a client-side SQL query in an unsafe way. An attacker may construct a URL that, when visited by another user, executes an arbitrary SQL query within that user's local browser SQL database.
What's compelling: The impact depends on what the browser database holds: if it stores sensitive data such as messages in a social networking application, an attacker may retrieve it, and if it stores pending user actions such as outgoing email messages, an attacker may modify that data and act on the user's behalf.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026