CWE-81 (错误消息Web页面中脚本转义处理不恰当) — Vulnerability Class 6

CWE-81 represents a critical input validation weakness where applications fail to properly sanitize special characters within error messages before rendering them in a web page. This vulnerability typically manifests when user-supplied data triggers an application error, causing the system to display a customized response, such as a 404 Not Found or 403 Forbidden page, that inadvertently includes the malicious input. Attackers exploit this flaw by injecting script syntax into the input fields, which the server then reflects directly into the error response without adequate neutralization. Consequently, when a victim views the error page, the embedded script executes in their browser, leading to cross-site scripting attacks that can compromise session tokens or redirect users to phishing sites. Developers mitigate this risk by implementing strict output encoding for all dynamic content within error pages, ensuring that any user-controlled data is treated as plain text rather than executable code, thereby preventing the browser from interpreting the input as active scripting elements.