XPath_Injection issue exists @ WebGoat/Content/XPathInjection.aspx.cs in branch master
The application's FindSalesPerson method constructs an XPath query, for navigating an XML document. The XPath query is created with SelectNodes, at line 24 of WebGoat\Content\XPathInjection.aspx.cs, using an untrusted string embedded in the expression.
This may enable an attacker to modify the XPath expression, leading to an XPath Injection attack.
The attacker may be able to inject the modified XPath expression via user input, QueryString_state, which is retrieved by the application in the Page_Load method, at line 16 of WebGoat\Content\XPathInjection.aspx.cs. This value then flows through the code to SelectNodes, as noted.
Prevelate
commented
4 years ago
XPath_Injection issue exists @ WebGoat/Content/XPathInjection.aspx.cs in branch master
The application's FindSalesPerson method constructs an XPath query, for navigating an XML document. The XPath query is created with SelectNodes, at line 24 of WebGoat\Content\XPathInjection.aspx.cs, using an untrusted string embedded in the expression. This may enable an attacker to modify the XPath expression, leading to an XPath Injection attack. The attacker may be able to inject the modified XPath expression via user input, QueryString_state, which is retrieved by the application in the Page_Load method, at line 16 of WebGoat\Content\XPathInjection.aspx.cs. This value then flows through the code to SelectNodes, as noted.
Severity: High
CWE:643
Vulnerability details and guidance
Checkmarx
Lines: 20
Code (Line #20):