What is stored cross-site scripting in SAP BC-SEC - Security?

SAP Term: stored cross-site scripting

• Component: BC-SEC

• Component Name: Security

• Description: A type of cross-site scripting attack in which the attacker stores the injected code or script on a vulnerable server. For example, the malicious code can be contained in a forum message. The malicious code remains in the Web application even when the current session that caused the exploitation has ended. Therefore, every user who accesses the Web application receives the injected code without any further intervention by the attacker.

Smart SAP Assistant

• Key Concepts: 
  Stored Cross-Site Scripting (XSS) is a type of security vulnerability in SAP systems that allows malicious code to be stored and executed on a web server. It is a type of injection attack, where malicious code is injected into a web application. This code can then be used to access sensitive data or perform malicious activities. 
  
  How to use it: 
  Stored XSS vulnerabilities can be exploited by attackers to gain access to sensitive data or perform malicious activities. To prevent stored XSS attacks, SAP systems should be configured with appropriate security settings and regularly monitored for any suspicious activity. Additionally, developers should ensure that all user input is properly validated and sanitized before being stored in the database. 
  
  Tips & Tricks: 
  To protect against stored XSS attacks, it is important to ensure that all user input is properly validated and sanitized before being stored in the database. Additionally, developers should use secure coding practices when developing web applications and regularly monitor for any suspicious activity. 
  
  Related Information: 
  For more information on stored XSS vulnerabilities and how to protect against them, please refer to the SAP Security Guide for BC-SEC Security (https://help.sap.com/viewer/product/BC-SEC/latest/en-US). Additionally, the OWASP Top 10 list of security vulnerabilities (https://www.owasp.org/index.php/Top_10_2013-Top_10) provides an overview of the most common security vulnerabilities and how to protect against them.