XPath Injection

High Web Application Scanning Plugin ID 98114


XPath Injection


XML Path Language (XPath) queries are used by web applications for selecting
nodes from XML documents.
Once selected, the value of these nodes can then be used by the application.

A simple example for the use of XML documents is to store user information. As
part of the authentication process, the application will perform an XPath query
to confirm the login credentials and retrieve that user's information to use in
the following request.

XPath injection occurs where untrusted data is used to build XPath queries.

Cyber-criminals may abuse this injection vulnerability to bypass authentication,
query other user's information, or, if the XML document contains privileged user
credentials, allow the cyber-criminal to escalate their privileges.

Scanner injected special XPath query characters into the page and based on the
responses from the server, has determined that the page is vulnerable to XPath injection.


The preferred way to protect against XPath injection is to utilise parameterized (also known as prepared) XPath queries. When utilising this method of querying the XML document any value supplied by the client will be handled as a string rather than part of the XPath query.
An alternative to parameterized queries it to use precompiled XPath queries. Precompiled XPath queries are not generated dynamically and will therefor never process user supplied input as XPath.

See Also



Plugin Details

Severity: High

ID: 98114

Type: remote

Family: Injection

Published: 2017/03/31

Updated: 2017/10/16

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3.0

Base Score: 7.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Reference Information

CWE: 91

WASC: XPath Injection

OWASP: 2017-A1, 2013-A1, 2010-A1