Queen of Elevation of Privilege II
You include user-generated content within your page, possibly including the content of random URLs.
|
Threat |
|
|
|
Your site allows users to add comments and they can insert code into the comments, which is stored directly in your database without sanitization. Subsequently, you are including it in a rendered page again without sanitization. |
|
CAPEC |
CAPEC-592 – Stored XSS |
|
ASVS |
5.1.3 – Validate all untrusted data and use allow lists where possible 5.2.1 – Ensure all untrusted input is sanitized 14.4.3 – Ensure you have applied Content Security Policies |
|
CWE |
CWE-183 – Permissive list of allowed inputs CWE-184 – Incomplete list of disallowed... |
