search

Prevelate / WebGoat.NET

OWASP WebGoat.NET
0 stars 0 forks source link

CX Reflected_XSS_All_Clients @ WebGoat/Content/PathManipulation.aspx.cs [master] #22

Open Prevelate opened 4 years ago

Prevelate commented 4 years ago

Reflected_XSS_All_Clients issue exists @ WebGoat/Content/PathManipulation.aspx.cs in branch master

Method Page_Load at line 13 of WebGoat\Content\PathManipulation.aspx.cs gets user input for the QueryString_filename element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method Page_Load at line 13 of WebGoat\Content\PathManipulation.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 33

Code (Line #33):

                string filename = Request.QueryString["filename"];
Prevelate commented 4 years ago

Issue still exists.