Stored_XSS @ /dsvw.py

[pedrompflopes]

Stored_XSS issue exists @ dsvw.py in branch main

The method do_GET embeds untrusted data in generated output with write, at line 80 of /dsvw.py. This untrusted data is embedded into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the generated web-page.

The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the do_GET method with connection, at line 26 of /dsvw.py. This untrusted data then flows through the code straight to the output web page, without sanitization. 

This can enable a Stored Cross-Site Scripting (XSS) attack.

Namespace: pedrompflopes
Repository: small-project
Repository Url: https://github.com/pedrompflopes/small-project
CxAST-Project: pedrompflopes/small-project
CxAST platform scan: c8ffe959-aafe-486d-a7e7-1ba92f6aee49
Branch: main
Application: small-project
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
CWE: 79
Lines: 26 35 37

---

References
Read more