Taint unsafe echo tag
taint-unsafe-echo-tag
taint-unsafe-echo-tag
Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from $_REQUEST[...]. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. In PHP you can encode or sanitize user input with htmlspecialchars or use automatic context-aware escaping with a template engine such as Latte.
Likelihood: HIGH
Confidence: MEDIUM
CWE:
- CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
OWASP:
- A07:2017 - Cross-Site Scripting (XSS)
- A03:2021 - Injection