Stored_XSS @ /Default.cs

[apcxtest]

Checkmarx (SAST): Stored_XSS
Security Issue: Read More about Stored_XSS
Applications: test_App
Checkmarx Project: apcxtest/test-repo-pub2
Repository URL: https://github.com/apcxtest/test-repo-pub2
Branch: main
Scan ID: 5072abd4-8e3e-49e3-b1b5-44426e72387c

---

The method Checkmarx_Container embeds untrusted data in generated output with Write, at line 1 of /Default.aspx. This untrusted data is embedded into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the generated web-page.

The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the Specials_CreateDataSource method with ds, at line 850 of /Default.cs. This untrusted data then flows through the code straight to the output web page, without sanitization. 

This can enable a Stored Cross-Site Scripting (XSS) attack.

Result #1:
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
Attack Vector:

    1. ds: /Default.cs[850,15]
    2. ds: /Default.cs[852,31]
    3. Tables: /Default.cs[852,34]
    4. DataView: /Default.cs[852,18]
    5. Source: /Default.cs[852,9]
    6. Source: /Default.cs[862,10]
    7. Specials_CreateDataSource: /Default.cs[869,34]
    8. DataSource: /Default.cs[869,21]
    9. Specials_Repeater: /Default.cs[869,3]
    10. Specials_Repeater: /Default.cs[870,3]
    11. Specials_Bind: /Default.cs[192,3]
    12. Page_Show: /Default.aspx[339,145]
    13. Checkmarx_Container: /Default.aspx[339,182]
    14. Specials_Repeater: /Default.aspx[1,944]
    15. Write: /Default.aspx[1,882]
    Review result in Checkmarx One: Stored_XSS

Result #2:
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
Attack Vector:

    1. ds: /Default.cs[757,15]
    2. ds: /Default.cs[759,31]
    3. Tables: /Default.cs[759,34]
    4. DataView: /Default.cs[759,18]
    5. Source: /Default.cs[759,9]
    6. Source: /Default.cs[769,10]
    7. Weekly_CreateDataSource: /Default.cs[776,32]
    8. DataSource: /Default.cs[776,19]
    9. Weekly_Repeater: /Default.cs[776,3]
    10. Weekly_Repeater: /Default.cs[777,3]
    11. Weekly_Bind: /Default.cs[191,3]
    12. Page_Show: /Default.aspx[339,145]
    13. Checkmarx_Container: /Default.aspx[339,182]
    14. Weekly_Repeater: /Default.aspx[1,3866]
    15. Write: /Default.aspx[1,3804]
    Review result in Checkmarx One: Stored_XSS

Result #3:
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
Attack Vector:

    1. ds: /Default.cs[659,15]
    2. ds: /Default.cs[661,31]
    3. Tables: /Default.cs[661,34]
    4. DataView: /Default.cs[661,18]
    5. Source: /Default.cs[661,9]
    6. Source: /Default.cs[671,10]
    7. New_CreateDataSource: /Default.cs[678,29]
    8. DataSource: /Default.cs[678,16]
    9. New_Repeater: /Default.cs[678,3]
    10. New_Repeater: /Default.cs[679,3]
    11. New_Bind: /Default.cs[190,3]
    12. Page_Show: /Default.aspx[339,145]
    13. Checkmarx_Container: /Default.aspx[339,182]
    14. New_Repeater: /Default.aspx[1,3178]
    15. Write: /Default.aspx[1,3116]
    Review result in Checkmarx One: Stored_XSS

Result #4:
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
Attack Vector:

    1. ds: /Default.cs[468,15]
    2. ds: /Default.cs[470,31]
    3. Tables: /Default.cs[470,34]
    4. DataView: /Default.cs[470,18]
    5. Source: /Default.cs[470,9]
    6. Source: /Default.cs[480,10]
    7. What_CreateDataSource: /Default.cs[487,30]
    8. DataSource: /Default.cs[487,17]
    9. What_Repeater: /Default.cs[487,3]
    10. What_Repeater: /Default.cs[488,3]
    11. What_Bind: /Default.cs[188,3]
    12. Page_Show: /Default.aspx[339,145]
    13. Checkmarx_Container: /Default.aspx[339,182]
    14. What_Repeater: /Default.aspx[1,2495]
    15. Write: /Default.aspx[1,2433]
    Review result in Checkmarx One: Stored_XSS

Result #5:
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
Attack Vector:

    1. ds: /Default.cs[355,15]
    2. ds: /Default.cs[362,31]
    3. Tables: /Default.cs[362,34]
    4. DataView: /Default.cs[362,18]
    5. Source: /Default.cs[362,9]
    6. Source: /Default.cs[372,10]
    7. Recommended_CreateDataSource: /Default.cs[389,37]
    8. DataSource: /Default.cs[389,24]
    9. Recommended_Repeater: /Default.cs[389,3]
    10. Recommended_Repeater: /Default.cs[390,3]
    11. Recommended_Bind: /Default.cs[187,3]
    12. Page_Show: /Default.aspx[339,145]
    13. Checkmarx_Container: /Default.aspx[339,182]
    14. Recommended_Repeater: /Default.aspx[1,1097]
    15. Write: /Default.aspx[1,1044]
    Review result in Checkmarx One: Stored_XSS

Result #6:
Severity: HIGH
State: URGENT
Status: RECURRENT
Attack Vector:

    1. ds: /Default.cs[560,15]
    2. ds: /Default.cs[562,31]
    3. Tables: /Default.cs[562,34]
    4. DataView: /Default.cs[562,18]
    5. Source: /Default.cs[562,9]
    6. Source: /Default.cs[572,10]
    7. Categories_CreateDataSource: /Default.cs[579,36]
    8. DataSource: /Default.cs[579,23]
    9. Categories_Repeater: /Default.cs[579,3]
    10. Categories_Repeater: /Default.cs[580,3]
    11. Categories_Bind: /Default.cs[189,3]
    12. Page_Show: /Default.aspx[339,145]
    13. Categories_Repeater: /Default.aspx[339,2242]
    14. Categories_Repeater: /Default.aspx[339,2271]
    15. Categories_Repeater: /Default.aspx[339,2300]
    16. Categories_Repeater: /Default.aspx[339,2334]
    17. Page_Load: /Default.aspx[339,122]
    18. Default: /Default.cs[126,25]
    19. CCUtility: /Default.cs[126,11]
    20. Utility: /Default.cs[126,3]
    21. Page_Load: /Default.aspx[339,122]
    22. Page_Show: /Default.aspx[339,145]
    23. Search_Show: /Default.cs[185,3]
    24. Utility: /Default.cs[214,2]
    25. Utility: /Default.cs[219,4]
    26. Utility: /Default.cs[224,4]
    27. Search_Show: /Default.cs[185,3]
    28. Page_Show: /Default.aspx[339,145]
    29. Weekly_Repeater_ItemDataBound: /Default.aspx[339,397]
    30. Utility: /Default.cs[703,104]
    31. Dlookup: /Default.cs[703,112]
    32. Text: /Default.cs[703,55]
    Review result in Checkmarx One: Stored_XSS