Cross-Site-Scripting Vulnerabilities Enable Customer Data Theft

Cybersecurity company Enginsight has emphasized the severity of Cross-Site-Scripting (XSS) vulnerabilities, which enable the theft of customer data through websites.

Recently, a case involving smartphone manufacturer OnePlus saw up to 40,000 customer credit card details stolen from their online store. The attack targeted the Magento e-commerce platform used by OnePlus, which was found to be susceptible to XSS attacks. As a result, attackers were able to intercept credit card numbers, expiry dates, and security codes.

OWASP, a well-known web security organization, lists XSS as one of the most common and serious security flaws. According to Enginsight, XSS vulnerabilities are on the rise and require immediate action from companies handling customer data online.

Cross-Site-Scripting works by an attacker successfully injecting malicious JavaScript code into a website. This code is then executed in the browsers of other website users without their knowledge. When a user visits an infected page, the malicious code loaded into their browser can, for instance, capture session information (session IDs), which are crucial for authenticating a user to an online service.

Using these captured session IDs, an attacker can impersonate the victim and access their information, including personal and payment details. Enginsight stresses that such attacks can cause significant financial and reputational damage to companies.