CWE-91 (XML注入(XPath盲注)) — Vulnerability Class 50

CWE-91, known as XML Injection or Blind XPath Injection, is a critical input validation weakness where applications fail to properly neutralize special characters within XML data. Attackers typically exploit this vulnerability by injecting malicious XPath queries into user-supplied input fields, manipulating the syntax of XML documents before they are processed. This allows adversaries to bypass authentication mechanisms, extract sensitive data, or alter application logic without receiving direct error feedback, hence the "blind" nature of the attack. To prevent such exploits, developers must rigorously sanitize all user inputs by escaping or removing dangerous characters like quotes and angle brackets. Additionally, employing parameterized queries or using secure XML parsing libraries that enforce strict schema validation ensures that user data is treated strictly as content rather than executable code, effectively neutralizing the injection vector.