CX Stored_XSS @ dvwa/includes/dvwaPage.inc.php [master]

[ghost]

Stored_XSS issue exists @ dvwa/includes/dvwaPage.inc.php in branch master

Method dvwaGuestbook at line 503 of dvwa\includes\dvwaPage.inc.php gets data from the database, for the mysqli_fetch_row element. This element’s value then flows through the code without being properly filtered or encoded and is eventually displayed to the user in method dvwaHtmlEcho at line 183 of dvwa\includes\dvwaPage.inc.php. This may enable a Stored Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Internal Guidance

Checkmarx

Training Recommended Fix

Lines: 509

---

Code (Line #509):

    while( $row = mysqli_fetch_row( $result ) ) {

---

[ghost]

Issue still exists.

[ghost]

Issue still exists.

[ghost]

Issue still exists.

[ghost]

Issue still exists.