search

jbruinaud / WebGoatNet

WebGoat .Net for demos
0 stars 0 forks source link

CX XSRF @ WebGoatCoins/ProductDetails.aspx.cs [master] #131

Open jbruinaud opened 4 years ago

jbruinaud commented 4 years ago

XSRF issue exists @ WebGoatCoins/ProductDetails.aspx.cs in branch master

Method btnSave_Click at line 37 of WebGoatCoins\ProductDetails.aspx.cs gets a parameter from a user request from Value. This parameter value flows through the code and is eventually used to access application state altering functionality. This may enable Cross-Site Request Forgery (XSRF).

Severity: Medium

CWE:352

Checkmarx

Lines: 41

Code (Line #41):

                string error_message = du.AddComment(hiddenFieldProductID.Value, txtEmail.Text, txtComment.Text);
jbruinaud commented 4 years ago

Issue still exists.

SUMMARY

Issue has total 1 vulnerabilities left to be fix (Please scroll to the top for more information)