A Survey on XPath Injection

Abstract

With the increasing use of internet technologies and online activities, Security of internet resources is also threatened day by day by malicious
activities done by attackers. Injection attack is one of the most threatening attacks. Nowadays XML is used as communication protocol in web
applications. The expressiveness and flexibility of XML gives opportunities for attackers to perform injection attacks. By using xml databases
instead of relational databases the web applications are more vulnerable to injection attacks. The major reason for severity of XML injection
attacks compared to SQL injection attacks is due to the lack of access control mechanism in XML databases. This paper introduces xml
based injection attacks with example for each and surveys XPath injection vulnerability detection techniques. Vulnerability
detection of XML based web applications can be done by static analysis or dynamic analysis.