1853
condition causes the WHERE clause to always evaluate to true, so the query becomes logically
equivalent to the much simpler query:
Example Language: (Attack)
SELECT * FROM items;
This simplification of the query allows the attacker to bypass the requirement that the query only
return items owned by the authenticated user; the query now returns all entries stored in the items
table, regardless of their specified owner.
Example 2:
The code below constructs an LDAP query using user input address data:
Example Language: Java (Bad)
context = new InitialDirContext(env);
String searchFilter = "StreetAddress=" + address;
NamingEnumeration answer = context.search(searchBase, searchFilter, searchCtls);
Because the code fails to neutralize the address string used to construct the query, an attacker can
supply an address that includes additional LDAP queries.
Example 3:
Consider the following simple XML document that stores authentication information and a snippet
of Java code that uses XPath query to retrieve authentication information:
Example Language: XML (Informative)
<users>
<user>
<login>john</login>
<password>abracadabra</password>
<home_dir>/home/john</home_dir>
</user>
<user>
<login>cbc</login>
<password>1mgr8</password>
<home_dir>/home/cbc</home_dir>
</user>
</users>
The Java code used to retrieve the home directory based on the provided credentials is:
Example Language: Java (Bad)
XPath xpath = XPathFactory.newInstance().newXPath();
XPathExpression xlogin = xpath.compile("//users/user[login/text()='" + login.getUserName() + "' and password/text() = '" +
login.getPassword() + "']/home_dir/text()");
Document d = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(new File("db.xml"));
String homedir = xlogin.evaluate(d);
Assume that user "john" wishes to leverage XPath Injection and login without a valid password. By
providing a username "john" and password "' or ''='" the XPath expression now becomes
Example Language: (Attack)
//users/user[login/text()='john' or ''='' and password/text() = '' or ''='']/home_dir/text()
This lets user "john" login without a valid password, thus bypassing authentication.
Observed Examples
CWE Version 4.14
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag