Synopsis
A web application is potentially vulnerable to XPath injection.
Description
By providing specially crafted parameters to CGIs, Nessus was able to get an error from the underlying XPath engine. This error suggests that the CGI is affected by an XPath injection vulnerability.
An attacker may exploit this flaw to bypass authentication or read confidential data.
Solution
Modify the relevant CGIs so that they properly escape arguments.
Plugin Details
File Name: torture_cgi_xpath_injection2.nasl
Supported Sensors: Nessus
Vulnerability Information
Required KB Items: Settings/enable_web_app_tests
Reference Information
CWE: 20, 209, 643, 713, 722, 727, 751, 77, 801, 810, 928, 929, 933