Practical Example Of CsSQLi Using (Google) Gears Via XSS

This report explains how persistent browser storage technologies (Google Gears and HTML5 Database Storage) can be abused via existing XSS vulnerabilities to perform client-side SQL injection (csSQLi), demonstrated with a proof-of-concept against Paymo.biz; it warns that although the storage APIs themselves are not insecure, implementing them on sites with XSS exposes local SQLite-backed databases to confidentiality and integrity compromises and recommends securing applications before enabling offline storage.