Stored_XSS @ /OrdersRecord.cs

[apcxtest]

Checkmarx (SAST): Stored_XSS
Security Issue: Read More about Stored_XSS
Applications: test_App
Checkmarx Project: apcxtest/test-repo-pub2
Repository URL: https://github.com/apcxtest/test-repo-pub2
Branch: main
Scan ID: 5072abd4-8e3e-49e3-b1b5-44426e72387c

---

The method Orders_Show embeds untrusted data in generated output with Text, at line 213 of /OrdersRecord.cs. This untrusted data is embedded into the output without proper sanitization or encoding, enabling an attacker to inject malicious code into the generated web-page.

The attacker would be able to alter the returned web page by saving malicious data in a data-store ahead of time. The attacker's modified data is then read from the database by the Orders_Show method with ds, at line 176 of /OrdersRecord.cs. This untrusted data then flows through the code straight to the output web page, without sanitization. 

This can enable a Stored Cross-Site Scripting (XSS) attack.

Result #1:
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
Attack Vector:

    1. ds: /OrdersRecord.cs[176,22]
    2. ds: /OrdersRecord.cs[177,9]
    3. Tables: /OrdersRecord.cs[177,12]
    4. Rows: /OrdersRecord.cs[177,22]
    5. row: /OrdersRecord.cs[177,3]
    6. row: /OrdersRecord.cs[200,44]
    7. GetValue: /OrdersRecord.cs[200,35]
    8. Text: /OrdersRecord.cs[200,18]
    9. Orders_quantity: /OrdersRecord.cs[200,2]
    10. Orders_Show: /OrdersRecord.cs[119,3]
    11. Page_Show: /OrdersRecord.aspx[111,145]
    12. Orders_quantity: /OrdersRecord.aspx[111,1859]
    13. Orders_quantity: /OrdersRecord.aspx[111,1884]
    14. Orders_quantity: /OrdersRecord.aspx[111,1909]
    15. Orders_quantity: /OrdersRecord.aspx[111,1939]
    16. Page_Load: /OrdersRecord.aspx[111,122]
    17. OrdersRecord: /OrdersRecord.cs[63,25]
    18. CCUtility: /OrdersRecord.cs[63,11]
    19. Utility: /OrdersRecord.cs[63,3]
    20. Utility: /OrdersRecord.cs[76,3]
    21. Page_Load: /OrdersRecord.aspx[111,122]
    22. Page_Show: /OrdersRecord.aspx[111,145]
    23. Orders_Show: /OrdersRecord.cs[119,3]
    24. Utility: /OrdersRecord.cs[159,2]
    25. Utility: /OrdersRecord.cs[160,1]
    26. Utility: /OrdersRecord.cs[213,12]
    27. GetParam: /OrdersRecord.cs[213,20]
    28. pValue: /OrdersRecord.cs[213,3]
    29. pValue: /OrdersRecord.cs[213,64]
    30. Text: /OrdersRecord.cs[213,57]
    Review result in Checkmarx One: Stored_XSS