Security Test: Stored Improper Input Validation Injection¶

Description¶

Default Severity: high

This vulnerability happens when an application does not carefully check or clean user input before saving it in a database, letting malicious code sneak in. The problem starts when attackers insert harmful code into the system, which later executes when other users access that stored data. This can allow attackers to perform actions like stealing sensitive information or hijacking user sessions. Often developers overlook thorough input validation or rely too heavily on client-side checks, which isn't enough to keep the data safe. If left unaddressed, this issue can compromise user data, undermine trust, and even open the door to more severe attacks in your application.

Reference:

• https://portswigger.net/web-security/cross-site-scripting

Configuration¶

Identifier: injection/improper_input_stored

Examples¶

All configuration available:

checks:
  injection/improper_input_stored:
    skip: false # default
    options:
      skip_objects: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶