XPath Injection
High · Injection · CWE-643
Description
User input in XPath queries alters logic.
Root cause
String-built XPath.
Impact
Auth bypass, data extraction.
Detection
XPath metacharacter tests.
Mitigation
Parameterized XPath APIs; input validation.
Secure coding
Avoid concatenating user input into XPath.
Safe lab example
XPath injection labs
Practise related skills in Labs or deepen on Academy library.