software composition analysis
Product
SAST
Catch vulnerabilities as you develop DAST
Test live web applications like an attacker SCA
Secure open-source and supply chain MAST
Secure mobile apps from code to store Compliance
Align with standards while shipping secure code
Resources
Vulnerability database Healthy Package
Blog News
Documentation
Pricing Partners About Us Log In
software composition analysis

Kotlin : XQuery injection

Classification

OWASP Top 10 2013 A1-Injection OWASP Top 10 2017 A1-Injection OWASP Top 10 2021 A3-Injection OWASP ASVS Validation, Sanitization and Encoding PCI DSS 4.0 6.2.4 HIPAA §164.312 (a)(1) §164.312 (d) CWE CWE-1027

Overview

XQuery injection is a variant of the classic SQL-injection. The attack vector in that case is XML database.

The application executes an XQuery expression generated on the basis of data from an untrusted source. This allows an attacker to change the semantics of the expression or execute arbitrary XQuery expressions.

References

  1. OWASP Top 10 2017-A1-Injection
  2. WASC: XQuery Injection
  3. CWE-652: Improper Neutralization of Data within XQuery Expressions (‘XQuery Injection’)
  4. CWE CATEGORY: OWASP Top Ten 2017 Category A1 - Injection

See also

Kotlin : Trust boundary violation
Kotlin : XSLT injection
Kotlin : DOS attack via regular expressions possible