14 lines
628 B
Plaintext
14 lines
628 B
Plaintext
|
XML injections occur when an application builds an XML-formatted string from
|
||
|
|
user input without prior validation or sanitation. In such a case, a tainted
|
||
|
|
user-controlled value can tamper with the XML string content. Especially,
|
||
|
|
unexpected arbitrary elements and attributes can be inserted in the
|
||
|
|
corresponding XML description.
|
||
|
|
|
||
|
|
A malicious injection payload could, for example:
|
||
|
|
|
||
|
|
* Insert tags into the main XML document.
|
||
|
|
* Add attributes to an existing XML tag.
|
||
|
|
* Change the data value inside a tag.
|
||
|
|
|
||
|
|
A malicious user-supplied value can perform other modifications depending on
|
||
|
|
where and how the constructed data is later used.
|