1766
Example Language: PHP (Bad)
$username = $_POST['username'];
$picSource = $_POST['picsource'];
$picAltText = $_POST['picalttext'];
...
echo "<title>Welcome, " . htmlentities($username) ."</title>";
echo "<img src='". htmlentities($picSource) ." ' alt='". htmlentities($picAltText) . '" />';
...
The programmer attempts to avoid XSS exploits (CWE-79) by encoding the POST values so they
will not be interpreted as valid HTML. However, the htmlentities() encoding is not appropriate when
the data are used as HTML attributes, allowing more attributes to be injected.
For example, an attacker can set picAltText to:
Example Language: (Attack)
"altTextHere' onload='alert(document.cookie)"
This will result in the generated HTML image tag:
Example Language: HTML (Result)
<img src='pic.jpg' alt='altTextHere' onload='alert(document.cookie)' />
The attacker can inject arbitrary javascript into the tag due to this incorrect encoding.
Observed Examples
Reference Description
CVE-2009-2814 Server does not properly handle requests that do not contain UTF-8 data;
browser assumes UTF-8, allowing XSS.
https://www.cve.org/CVERecord?id=CVE-2009-2814
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 845 The CERT Oracle Secure Coding Standard for
Java (2011) Chapter 2 - Input Validation and Data
Sanitization (IDS)
844 2362
MemberOf 867 2011 Top 25 - Weaknesses On the Cusp 900 2372
MemberOf 884 CWE Cross-section 884 2567
MemberOf 1138 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 04. Characters and Strings (STR)
1133 2446
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
The CERT Oracle Secure
Coding Standard for Java
(2011)
IDS13-J Use compatible encodings on both
sides of file or network IO
Related Attack Patterns
CAPEC-ID Attack Pattern Name
468 Generic Cross-Browser Cross-Domain Theft
CWE Version 4.14
CWE-839: Numeric Range Comparison Without Minimum Check
CWE-839: Numeric Range Comparison Without Minimum Check