XPath_Injection @ XPathQuery.java

[TaynaCT]

XPath_Injection issue exists @ XPathQuery.java in branch netbeans

The application's processRequest method constructs an XPath query, for navigating an XML document. The XPath query is created with compile, at line 53 of /src/java/controller/XPathQuery.java, using an untrusted string embedded in the expression.  

This may enable an attacker to modify the XPath expression, leading to an XPath Injection attack.

The attacker may be able to inject the modified XPath expression via user input, ""password"", which is retrieved by the application in the processRequest method, at line 36 of /src/java/controller/XPathQuery.java. This value then flows through the code to compile, as noted.

Namespace: TaynaCT
Repository: JavaVulnerableLab
Repository Url: https://github.com/TaynaCT/JavaVulnerableLab
CxAST-Project: TaynaCT/JavaVulnerableLab
CxAST platform scan: ec6e1015-2689-4742-939a-0072f10bf172
Branch: netbeans
Application: JavaVulnerableLab
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
CWE: 643
Lines: 35 36

---

References
Read more