1419
Reference Description
https://www.cve.org/CVERecord?id=CVE-2008-5642
CVE-2008-5125 Application allows admin privileges by setting a cookie value to "admin."
https://www.cve.org/CVERecord?id=CVE-2008-5125
CVE-2008-5065 Application allows admin privileges by setting a cookie value to "admin."
https://www.cve.org/CVERecord?id=CVE-2008-5065
CVE-2008-4752 Application allows admin privileges by setting a cookie value to "admin."
https://www.cve.org/CVERecord?id=CVE-2008-4752
CVE-2000-0102 Shopping cart allows price modification via hidden form field.
https://www.cve.org/CVERecord?id=CVE-2000-0102
CVE-2000-0253 Shopping cart allows price modification via hidden form field.
https://www.cve.org/CVERecord?id=CVE-2000-0253
CVE-2008-1319 Server allows client to specify the search path, which can be modified to point
to a program that the client has uploaded.
https://www.cve.org/CVERecord?id=CVE-2008-1319
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 752 2009 Top 25 - Risky Resource Management 750 2353
MemberOf 884 CWE Cross-section 884 2567
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1403 Comprehensive Categorization: Exposed Resource 1400 2528
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP23 Exposed Data
Related Attack Patterns
CAPEC-ID Attack Pattern Name
21 Exploitation of Trusted Identifiers
31 Accessing/Intercepting/Modifying HTTP Cookies
References
[REF-528]OWASP. "Top 10 2007-Insecure Direct Object Reference". 2007. < http://
www.owasp.org/index.php/Top_10_2007-A4 >.
[REF-529]"HMAC". 2011 August 8. Wikipedia. < https://en.wikipedia.org/wiki/HMAC >.2023-04-07.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath
Injection')
Weakness ID : 643
Structure : Simple
Abstraction : Base
Description
CWE Version 4.14
CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')
CWE-643: Improper Neutralization of Data
within XPath Expressions ('XPath Injection') 1420
The product uses external input to dynamically construct an XPath expression used to retrieve data
from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an
attacker to control the structure of the query.
Extended Description
The net effect is that the attacker will have control over the information selected from the XML
database and may use that ability to control application flow, modify logic, retrieve unauthorized
data, or bypass important checks (e.g. authentication).
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 91 XML Injection (aka Blind XPath Injection) 215
ChildOf 943 Improper Neutralization of Special Elements in Data Query
Logic