173
/.../
The code is careful to avoid a SQL injection attack (CWE-89) but does not stop valid HTML
from being stored in the database. This can be exploited later when ListUsers.php retrieves the
information:
ListUsers.php
Example Language: PHP (Bad)
$query = 'Select * From users Where loggedIn=true';
$results = mysql_query($query);
if (!$results) {
exit;
}
//Print list of users to page
echo '<div id="userlist">Currently Active Users:';
while ($row = mysql_fetch_assoc($results)) {
echo '<div class="userNames">'.$row['fullname'].'</div>';
}
echo '</div>';
The attacker can set their name to be arbitrary HTML, which will then be displayed to all visitors of
the Active Users page. This HTML can, for example, be a password stealing Login message.
Example 5:
The following code is a simplistic message board that saves messages in HTML format and
appends them to a file. When a new user arrives in the room, it makes an announcement:
Example Language: PHP (Bad)
$name = $_COOKIE["myname"];
$announceStr = "$name just logged in.";
//save HTML-formatted message to file; implementation details are irrelevant for this example.
saveMessage($announceStr);
An attacker may be able to perform an HTML injection (Type 2 XSS) attack by setting a cookie to a
value like:
Example Language: (Attack)
<script>document.alert('Hacked');</script>
The raw contents of the message file would look like:
Example Language: (Result)
<script>document.alert('Hacked');</script> has logged in.
For each person who visits the message page, their browser would execute the script, generating a
pop-up window that says "Hacked". More malicious attacks are possible; see the rest of this entry.
Observed Examples
Reference Description
CVE-2021-25926 Python Library Manager did not sufficiently neutralize a user-supplied search
term, allowing reflected XSS.
https://www.cve.org/CVERecord?id=CVE-2021-25926
CVE-2021-25963 Python-based e-commerce platform did not escape returned content on error
pages, allowing for reflected Cross-Site Scripting attacks.
https://www.cve.org/CVERecord?id=CVE-2021-25963
CWE Version 4.14
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79: Improper Neutralization of Input During
Web Page Generation ('Cross-site Scripting') 174
Reference Description
CVE-2021-1879 Universal XSS in mobile operating system, as exploited in the wild per CISA
KEV.
https://www.cve.org/CVERecord?id=CVE-2021-1879
CVE-2020-3580 Chain: improper input validation (CWE-20) in firewall product leads to XSS
(CWE-79), as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-3580
CVE-2014-8958 Admin GUI allows XSS through cookie.
https://www.cve.org/CVERecord?id=CVE-2014-8958
CVE-2017-9764 Web stats program allows XSS through crafted HTTP header.
https://www.cve.org/CVERecord?id=CVE-2017-9764
CVE-2014-5198 Web log analysis product allows XSS through crafted HTTP Referer header.
https://www.cve.org/CVERecord?id=CVE-2014-5198
CVE-2008-5080 Chain: protection mechanism failure allows XSS
https://www.cve.org/CVERecord?id=CVE-2008-5080
CVE-2006-4308 Chain: incomplete denylist (CWE-184) only checks "javascript:" tag, allowing
XSS (CWE-79) using other tags
https://www.cve.org/CVERecord?id=CVE-2006-4308
CVE-2007-5727 Chain: incomplete denylist (CWE-184) only removes SCRIPT tags, enabling
XSS (CWE-79)
https://www.cve.org/CVERecord?id=CVE-2007-5727
CVE-2008-5770 Reflected XSS using the PATH_INFO in a URL
https://www.cve.org/CVERecord?id=CVE-2008-5770
CVE-2008-4730 Reflected XSS not properly handled when generating an error message
https://www.cve.org/CVERecord?id=CVE-2008-4730
CVE-2008-5734 Reflected XSS sent through email message.
https://www.cve.org/CVERecord?id=CVE-2008-5734
CVE-2008-0971 Stored XSS in a security product.
https://www.cve.org/CVERecord?id=CVE-2008-0971
CVE-2008-5249 Stored XSS using a wiki page.
https://www.cve.org/CVERecord?id=CVE-2008-5249
CVE-2006-3568 Stored XSS in a guestbook application.
https://www.cve.org/CVERecord?id=CVE-2006-3568
CVE-2006-3211 Stored XSS in a guestbook application using a javascript: URI in a bbcode img
tag.
https://www.cve.org/CVERecord?id=CVE-2006-3211
CVE-2006-3295 Chain: library file is not protected against a direct request (CWE-425), leading
to reflected XSS (CWE-79).
https://www.cve.org/CVERecord?id=CVE-2006-3295
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
MemberOf 712 OWASP Top Ten 2007 Category A1 - Cross Site
Scripting (XSS)
629 2330
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
MemberOf 725 OWASP Top Ten 2004 Category A4 - Cross-Site
Scripting (XSS) Flaws
711 2336
MemberOf 751 2009 Top 25 - Insecure Interaction Between
Components
750 2352
CWE Version 4.14
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-79: Improper Neutralization of Input During
Web Page Generation ('Cross-site Scripting')