prevelate / webgoat.net Goto Github PK

SQL_Injection issue exists @ WebGoat/WebGoatCoins/ProductDetails.aspx.cs in branch master

The application's GetProductDetails method executes an SQL query with da, at line 406 of WebGoat\App_Code\DB\MySqlDbProvider.cs. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
The attacker would be able to inject arbitrary data into the SQL query, by simply altering the user input Request, which is read by the LoadComments method at line 53 of WebGoat\WebGoatCoins\ProductDetails.aspx.cs. This input then flows through the code to the database server, without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Lines: 55 89 41

Code (Line #55):

            string id = Request["productNumber"];

Code (Line #89):

                string customerNumber = Request.Cookies["customerNumber"].Value;

Code (Line #41):

                string error_message = du.AddComment(hiddenFieldProductID.Value, txtEmail.Text, txtComment.Text);

Reflected_XSS_All_Clients issue exists @ WebGoat/App_Code/DB/SqliteDbProvider.cs in branch master

Method GetSecurityQuestionAndAnswer at line 282 of WebGoat\App_Code\DB\SqliteDbProvider.cs gets user input for the row element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method ButtonCheckEmail_Click at line 26 of WebGoat\WebGoatCoins\ForgotPassword.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 300 301

Code (Line #300):

                    qAndA[0] = row[0].ToString();

Code (Line #301):

                    qAndA[1] = row[1].ToString();

SQL_Injection issue exists @ WebGoat/WebGoatCoins/MainPage.aspx.cs in branch master

The application's GetCustomerDetails method executes an SQL query with da, at line 215 of WebGoat\App_Code\DB\MySqlDbProvider.cs. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
The attacker would be able to inject arbitrary data into the SQL query, by simply altering the user input Value, which is read by the Page_Load method at line 22 of WebGoat\WebGoatCoins\MainPage.aspx.cs. This input then flows through the code to the database server, without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Lines: 27

Code (Line #27):

                string customerNumber = Request.Cookies["customerNumber"].Value;

Reflected_XSS_All_Clients issue exists @ WebGoat/WebGoatCoins/Orders.aspx.cs in branch master

Method Page_Load at line 20 of WebGoat\WebGoatCoins\Orders.aspx.cs gets user input for the RawUrl element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method Page_Load at line 20 of WebGoat\WebGoatCoins\Orders.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 114 77 62

Code (Line #114):

                link.Text = e.Row.Cells[0].Text;

Code (Line #77):

                        HyperLink1.NavigateUrl = Request.RawUrl + "&image=images/products/" + image;

Code (Line #62):

                string orderNumber = Request["orderNumber"];

Reflected_XSS_All_Clients issue exists @ WebGoat/Content/UploadPathManipulation.aspx.cs in branch master

Method btnUpload_Click at line 18 of WebGoat\Content\UploadPathManipulation.aspx.cs gets user input for the FileName element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method btnUpload_Click at line 18 of WebGoat\Content\UploadPathManipulation.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 26

Code (Line #26):

                    labelUpload.Text = "<div class='success' style='text-align:center'>The file " + FileUpload1.FileName + " has been saved in to the WebGoatCoins/uploads directory</div>";

XPath_Injection issue exists @ WebGoat/Content/XPathInjection.aspx.cs in branch master

The application's FindSalesPerson method constructs an XPath query, for navigating an XML document. The XPath query is created with SelectNodes, at line 24 of WebGoat\Content\XPathInjection.aspx.cs, using an untrusted string embedded in the expression.  
This may enable an attacker to modify the XPath expression, leading to an XPath Injection attack. 
 
The attacker may be able to inject the modified XPath expression via user input, QueryString_state, which is retrieved by the application in the Page_Load method, at line 16 of WebGoat\Content\XPathInjection.aspx.cs. This value then flows through the code to SelectNodes, as noted.

Severity: High

CWE:643

Vulnerability details and guidance

Checkmarx

Lines: 20

Code (Line #20):

                FindSalesPerson(Request.QueryString["state"]);

SQL_Injection issue exists @ WebGoat/Content/SQLInjection.aspx.cs in branch master

The application's GetEmailByName method executes an SQL query with da, at line 515 of WebGoat\App_Code\DB\MySqlDbProvider.cs. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
The attacker would be able to inject arbitrary data into the SQL query, by simply altering the user input Text, which is read by the btnFind_Click method at line 23 of WebGoat\Content\SQLInjection.aspx.cs. This input then flows through the code to the database server, without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Lines: 25

Code (Line #25):

            string name = txtName.Text;

Reflected_XSS_All_Clients issue exists @ WebGoat/WebGoatCoins/CustomerLogin.aspx in branch master

Method %> at line 1 of WebGoat\WebGoatCoins\CustomerLogin.aspx gets user input for the Request element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method %> at line 1 of WebGoat\WebGoatCoins\CustomerLogin.aspx. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 9

Code (Line #9):

        //var return_url = <%= Request["ReturnUrl"] == null ? "\"\"" : "\"" + Request["ReturnUrl"].ToString() + "\"" %>

Stored_XSS issue exists @ WebGoat/Content/ReadlineDoS.aspx.cs in branch master

Method btnUpload_Click at line 14 of WebGoat\Content\ReadlineDoS.aspx.cs gets data from the database, for the ReadLine element. This element’s value then flows through the code without being properly filtered or encoded and is eventually displayed to the user in method btnUpload_Click at line 14 of WebGoat\Content\ReadlineDoS.aspx.cs. This may enable a Stored Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 23

Code (Line #23):

                    lblFileContent.Text += reader.ReadLine() + "<br />";

SQL_Injection issue exists @ WebGoat/Content/StoredXSS.aspx.cs in branch master

The application's AddComment method executes an SQL query with command, at line 271 of WebGoat\App_Code\DB\MySqlDbProvider.cs. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
The attacker would be able to inject arbitrary data into the SQL query, by simply altering the user input Text, which is read by the btnSave_Click method at line 26 of WebGoat\Content\StoredXSS.aspx.cs. This input then flows through the code to the database server, without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Lines: 30

Code (Line #30):

                string error_message = du.AddComment("user_cmt", txtEmail.Text, txtComment.Text);

Stored_XSS issue exists @ WebGoat/App_Code/DB/SqliteDbProvider.cs in branch master

Method GetEmailByCustomerNumber at line 496 of WebGoat\App_Code\DB\SqliteDbProvider.cs gets data from the database, for the ExecuteScalar element. This element’s value then flows through the code without being properly filtered or encoded and is eventually displayed to the user in method btnFind_Click at line 23 of WebGoat\Content\SQLInjectionDiscovery.aspx.cs. This may enable a Stored Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 506

Code (Line #506):

                    output = (string)cmd.ExecuteScalar();

Reflected_XSS_All_Clients issue exists @ WebGoat/Content/HeaderInjection.aspx.cs in branch master

Method Page_Load at line 13 of WebGoat\Content\HeaderInjection.aspx.cs gets user input for the Console element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method Page_Load at line 13 of WebGoat\Content\HeaderInjection.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 16

Code (Line #16):

            lblHeaders.Text = Request.Headers.Console.WriteLine().Replace("&", "<br />");;

Reflected_XSS_All_Clients issue exists @ WebGoat/Content/ReflectedXSS.aspx.cs in branch master

Method Page_Load at line 17 of WebGoat\Content\ReflectedXSS.aspx.cs gets user input for the Request element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method LoadCity at line 23 of WebGoat\Content\ReflectedXSS.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 20

Code (Line #20):

                LoadCity(Request["city"]);

SQL_Injection issue exists @ WebGoat/WebGoatCoins/Autocomplete.ashx.cs in branch master

The application's GetCustomerEmails method executes an SQL query with da, at line 557 of WebGoat\App_Code\DB\MySqlDbProvider.cs. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
The attacker would be able to inject arbitrary data into the SQL query, by simply altering the user input Request, which is read by the ProcessRequest method at line 20 of WebGoat\WebGoatCoins\Autocomplete.ashx.cs. This input then flows through the code to the database server, without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Lines: 25

Code (Line #25):

            string query = context.Request["query"];

Reflected_XSS_All_Clients issue exists @ WebGoat/WebGoatCoins/ProductDetails.aspx in branch master

Method %> at line 1 of WebGoat\WebGoatCoins\ProductDetails.aspx gets user input for the Request element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method %> at line 1 of WebGoat\WebGoatCoins\ProductDetails.aspx. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 19

Code (Line #19):

    <h1 class="title-regular-4 clearfix">Details for <%=(Request["productNumber"] == null ? "This Month's Special" : "Product #" + Request["productNumber"].ToString()) %></h1>

Reflected_XSS_All_Clients issue exists @ WebGoat/WebGoatCoins/MainPage.aspx.cs in branch master

Method Page_Load at line 22 of WebGoat\WebGoatCoins\MainPage.aspx.cs gets user input for the row element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method Page_Load at line 22 of WebGoat\WebGoatCoins\MainPage.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 32 42

Code (Line #32):

                Image1.ImageUrl = "images/logos/" + row["logoFileName"];

Code (Line #42):

                    cell2.Text = row[col].ToString();

Reflected_XSS_All_Clients issue exists @ WebGoat/Content/SQLInjectionDiscovery.aspx.cs in branch master

Method btnFind_Click at line 23 of WebGoat\Content\SQLInjectionDiscovery.aspx.cs gets user input for the Text element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method btnFind_Click at line 23 of WebGoat\Content\SQLInjectionDiscovery.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 27

Code (Line #27):

                string name = txtID.Text.Substring(0, 3);

Reflected_XSS_All_Clients issue exists @ WebGoat/Content/EncryptVSEncode.aspx.cs in branch master

Method btnGO_Click at line 25 of WebGoat\Content\EncryptVSEncode.aspx.cs gets user input for the Text element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method MakeRow at line 51 of WebGoat\Content\EncryptVSEncode.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 32

Code (Line #32):

			string secret = txtString.Text;

Reflected_XSS_All_Clients issue exists @ WebGoat/WebGoatCoins/ProductDetails.aspx.cs in branch master

Method LoadComments at line 53 of WebGoat\WebGoatCoins\ProductDetails.aspx.cs gets user input for the prodRow element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method LoadComments at line 53 of WebGoat\WebGoatCoins\ProductDetails.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 64 65 68 76 77 63

Code (Line #64):

                output += "<strong>" + prodRow["productName"].ToString() + "</strong><br/>";

Code (Line #65):

                output += "<hr/>" + prodRow["productDescription"].ToString() + "<br/>";

Code (Line #68):

                hiddenFieldProductID.Value = prodRow["productCode"].ToString();

Code (Line #76):

                    comments += "<strong>Email:</strong>" + commentRow["email"] + "<span style='font-size: x-small;color: #E47911;'> (Email Address Verified!) </span><br/>";

Code (Line #77):

                    comments += "<strong>Comment:</strong><br/>" + commentRow["comment"] + "<br/><hr/>";

Code (Line #63):

                output += "<img src='./images/products/" + prodRow["productImage"] + "'/><br/>";

Reflected_XSS_All_Clients issue exists @ WebGoat/Content/StoredXSS.aspx.cs in branch master

Method LoadComments at line 42 of WebGoat\Content\StoredXSS.aspx.cs gets user input for the row element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method LoadComments at line 42 of WebGoat\Content\StoredXSS.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 48 49

Code (Line #48):

                comments += "<strong>Email:</strong>" + row["email"] + "<span style='font-size: x-small;color: #E47911;'> (Email Address Verified!) </span><br/>";

Code (Line #49):

                comments += "<strong>Comment:</strong><br/>" + row["comment"] + "<br/><hr/>";

Reflected_XSS_All_Clients issue exists @ WebGoat/Content/PathManipulation.aspx.cs in branch master

Method Page_Load at line 13 of WebGoat\Content\PathManipulation.aspx.cs gets user input for the QueryString_filename element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method Page_Load at line 13 of WebGoat\Content\PathManipulation.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 33

Code (Line #33):

        		string filename = Request.QueryString["filename"];

Reflected_XSS_All_Clients issue exists @ WebGoat/WebGoatCoins/CustomerLogin.aspx.cs in branch master

Method ButtonLogOn_Click at line 31 of WebGoat\WebGoatCoins\CustomerLogin.aspx.cs gets user input for the Text element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method ButtonLogOn_Click at line 31 of WebGoat\WebGoatCoins\CustomerLogin.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 33

Code (Line #33):

            string email = txtUserName.Text;

Second_Order_SQL_Injection issue exists @ WebGoat/Code/DatabaseUtilities.cs in branch master

The application's DoNonQuery method executes an SQL query with cmd, at line 73 of WebGoat\Code\DatabaseUtilities.cs. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
The attacker may be able to write arbitrary data to the database, which is then retrieved by the application with ReadLine in RunSQLFromFile method at line 46 of WebGoat\Code\DatabaseUtilities.cs. This data then flows through the code, until it is used directly in the SQL query without sanitization, and then submitted to the database server for execution.
This may enable a Second-Order SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Lines: 51

Code (Line #51):

					while ((line = sr.ReadLine ()) != null) {

SQL_Injection issue exists @ WebGoat/WebGoatCoins/CustomerLogin.aspx.cs in branch master

The application's IsValidCustomerLogin method executes an SQL query with da, at line 112 of WebGoat\App_Code\DB\MySqlDbProvider.cs. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
The attacker would be able to inject arbitrary data into the SQL query, by simply altering the user input Text, which is read by the ButtonLogOn_Click method at line 31 of WebGoat\WebGoatCoins\CustomerLogin.aspx.cs. This input then flows through the code to the database server, without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Lines: 33

Code (Line #33):

            string email = txtUserName.Text;

Reflected_XSS_All_Clients issue exists @ WebGoat/ProxySetup.aspx.cs in branch master

Method btnReverse_Click at line 12 of WebGoat\ProxySetup.aspx.cs gets user input for the Text element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method btnReverse_Click at line 12 of WebGoat\ProxySetup.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 15

Code (Line #15):

            var name = txtName.Text;

Reflected_XSS_All_Clients issue exists @ WebGoat/App_Code/DB/MySqlDbProvider.cs in branch master

Method GetSecurityQuestionAndAnswer at line 319 of WebGoat\App_Code\DB\MySqlDbProvider.cs gets user input for the row element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method ButtonCheckEmail_Click at line 26 of WebGoat\WebGoatCoins\ForgotPassword.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 337 338

Code (Line #337):

                    qAndA[0] = row[0].ToString();

Code (Line #338):

                    qAndA[1] = row[1].ToString();

Reflected_XSS_All_Clients issue exists @ WebGoat/WebGoatCoins/Catalog.aspx.cs in branch master

Method Page_Load at line 17 of WebGoat\WebGoatCoins\Catalog.aspx.cs gets user input for the prodRow element. This element’s value then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method Page_Load at line 17 of WebGoat\WebGoatCoins\Catalog.aspx.cs. This may enable a Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 27 28 29

Code (Line #27):

                    lblOutput.Text += "<img src='./images/products/" + prodRow[3] + "'/><br/>\n";

Code (Line #28):

                    lblOutput.Text += "" + prodRow[1] + "<br/>\n";

Code (Line #29):

                    lblOutput.Text += "<a href=\"ProductDetails.aspx?productNumber=" + prodRow[0].ToString() + "\"><br/>\n";

Stored_XSS issue exists @ WebGoat/Content/PathManipulation.aspx.cs in branch master

Method ResponseFile at line 49 of WebGoat\Content\PathManipulation.aspx.cs gets data from the database, for the ReadBytes element. This element’s value then flows through the code without being properly filtered or encoded and is eventually displayed to the user in method ResponseFile at line 49 of WebGoat\Content\PathManipulation.aspx.cs. This may enable a Stored Cross-Site-Scripting attack.

Severity: High

CWE:79

Vulnerability details and guidance

Checkmarx

Lines: 88

Code (Line #88):

	                        _Response.BinaryWrite(br.ReadBytes(pack));

SQL_Injection issue exists @ WebGoat/Content/ForgotPassword.aspx.cs in branch master

The application's GetSecurityQuestionAndAnswer method executes an SQL query with da, at line 319 of WebGoat\App_Code\DB\MySqlDbProvider.cs. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
The attacker would be able to inject arbitrary data into the SQL query, by simply altering the user input Text, which is read by the ButtonCheckEmail_Click method at line 25 of WebGoat\Content\ForgotPassword.aspx.cs. This input then flows through the code to the database server, without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Lines: 66 27

Code (Line #66):

                    labelPassword.Text = "Security Question Challenge Successfully Completed! <br/>Your password is: " + getPassword(txtEmail.Text);

Code (Line #27):

            string[] result = du.GetSecurityQuestionAndAnswer(txtEmail.Text);

SQL_Injection issue exists @ WebGoat/WebGoatCoins/ForgotPassword.aspx.cs in branch master

The application's GetSecurityQuestionAndAnswer method executes an SQL query with da, at line 319 of WebGoat\App_Code\DB\MySqlDbProvider.cs. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
The attacker would be able to inject arbitrary data into the SQL query, by simply altering the user input Text, which is read by the ButtonCheckEmail_Click method at line 26 of WebGoat\WebGoatCoins\ForgotPassword.aspx.cs. This input then flows through the code to the database server, without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Lines: 67 28

Code (Line #67):

                    labelPassword.Text = "Security Question Challenge Successfully Completed! <br/>Your password is: " + getPassword(txtEmail.Text);

Code (Line #28):

            string[] result = du.GetSecurityQuestionAndAnswer(txtEmail.Text);

SQL_Injection issue exists @ WebGoat/Content/SQLInjectionDiscovery.aspx.cs in branch master

The application's GetEmailByCustomerNumber method executes an SQL query with cmd, at line 496 of WebGoat\App_Code\DB\SqliteDbProvider.cs. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
The attacker would be able to inject arbitrary data into the SQL query, by simply altering the user input Text, which is read by the btnFind_Click method at line 23 of WebGoat\Content\SQLInjectionDiscovery.aspx.cs. This input then flows through the code to the database server, without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Lines: 27

Code (Line #27):

                string name = txtID.Text.Substring(0, 3);