DerScanner
Home / Vulnerability Database / C-sharp : XML without validation
C#

C-sharp : XML without validation

Classification

OWASP Top 10 2013
A1-Injection
OWASP Top 10 2017
A1-Injection
OWASP Top 10 2021
A3-Injection
OWASP ASVS
Validation, Sanitization and EncodingValidation, Sanitization and Encoding
PCI DSS 4.0
6.2.4
CWE
CWE-1027

Overview

The application does not validate the XML file. An attacker can submit malicious or malformed file.

Injection attacks take the first place in the “OWASP Top 10 2017” web application vulnerabilities ranking and the seventh place in the “OWASP Mobile Top 10 2014” ranking. The level of potential damage from such an attack depends on the user input validation performance and file protection mechanisms.

References

  1. OWASP Top 10 2017-A1-Injection
  2. OWASP Top 10 2013-A1-Injection
  3. CWE-91: XML Injection (aka Blind XPath Injection)
  4. XmlReader Class - msdn.microsoft.com
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A1 - Injection
MEDIUM

DerScanner Severity Score

Do you want to fix C-sharp : XML without validation in your application?

See also

C#

C-sharp : JWT: None Algorithm

C#

C-sharp : Insecure data transmission: Database

C#

C-sharp : Only one of method Equals() and GetHashCode() defined