Stored_XSS @ /MembersGrid.cs

[apcxtest]

Checkmarx (SAST): Stored_XSS
Security Issue: Read More about Stored_XSS
Applications: ilidioc_App, Microsserviços Produtivos, test_App
Checkmarx Project: apcxtestorg/testrepo
Repository URL: https://github.com/apcxtestorg/testrepo
Branch: main
Scan ID: a078e21a-b6dc-4705-a0cf-3262f0044fe1

---

The method Checkmarx_Container embeds untrusted data in generated output with Write, at line 1 of /MembersGrid.aspx. This untrusted data is embedded into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the generated web-page.

The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the Members_CreateDataSource method with ds, at line 287 of /MembersGrid.cs. This untrusted data then flows through the code straight to the output web page, without sanitization. 

This can enable a Stored Cross-Site Scripting (XSS) attack.

Result #1:
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
Attack Vector:

    1. ds: /MembersGrid.cs[287,15]
    2. ds: /MembersGrid.cs[294,31]
    3. Tables: /MembersGrid.cs[294,34]
    4. DataView: /MembersGrid.cs[294,18]
    5. Source: /MembersGrid.cs[294,9]
    6. Source: /MembersGrid.cs[304,10]
    7. Members_CreateDataSource: /MembersGrid.cs[321,33]
    8. DataSource: /MembersGrid.cs[321,20]
    9. Members_Repeater: /MembersGrid.cs[321,3]
    10. Members_Repeater: /MembersGrid.cs[322,3]
    11. Members_Bind: /MembersGrid.cs[130,3]
    12. Page_Show: /MembersGrid.aspx[126,145]
    13. Checkmarx_Container: /MembersGrid.aspx[126,182]
    14. Members_Repeater: /MembersGrid.aspx[1,313]
    15. Write: /MembersGrid.aspx[1,241]
    Review result in Checkmarx One: Stored_XSS