# LogInjector: Detecting Web Application Log Injection Vulnerabilities
## 6 Evaluation
### Effectiveness
#### 6.2.2 Zero-Day Vulnerability Detection  
The effectiveness of LogInjector has been preliminarily proved through previous experiments. Next, we verify the effectiveness of LogInjector for zero-day log injection vulnerability detection. We selected the web applications shown in the first column of Table 6, including the web applications used in previous similar work [11; 15; 29] experiments, and finally, we detected a total of six zero-day log injection vulnerabilities, five of which can lead to remote code execution and one that can cause cross-site scripting execution. We have notified the corresponding manufacturers of the details of these vulnerabilities and reported them to CNVD (China National Vulnerability Database). Table 6 lists the details of the zero-day vulnerabilities detected by LogInjector, including web applications and their version numbers, vulnerability types, and obtained vulnerability numbers. LogInjector could identify that among the above six web applications, PHPFusion will store the log in the database, and the remaining five will store the log in the file. For AbanteCart, LogInjector imports files with specific content in the file upload form of AbanteCart's data import module. When the AbanteCart application back-end program imports data according to the file content, because the file content does not meet the required format, the code execution error is reported, and the error message is recorded in the in the in the corresponding log file. For the other five web applications, LogInjector can submit specific input in the identified form and find the log-injectable interfaces. In addition, LogInjector can identify the view-logs interfaces of these six applications based on dynamic crawler and static features. After successfully identifying the log-injectable interfaces and the view-logs interfaces, LogInjector performs dynamic testing according to Algorithm 1. First, it fills the five initial inputs in Table 2 into the log-injectable interfaces in turn and stores them in the _heaptree_ as initial test cases. Second, it takes a test case from the _heaptree_ for testing and calculates the score of the test case according to the feedback information in Table 3. Third, it uses the vulnerability verification mechanism proposed in Section 5.3.5 to verify whether the current test case triggers the vulnerability. If the current test case triggers an RCE vulnerability or an XSS vulnerability, LogInjector stops detection and outputs a successful test case. If the current test case does not trigger the vulnerability, LogInjector compares whether the score of the current test case is higher than the score of the test case with the highest score in the _heaptree_; if it is higher, the current test case is added to the _heaptree_, and otherwise, the score of the test case decreases by 0.1. Then, LogInjector selects the test case with the highest score from the _heaptree_ and randomly performs the \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Web Application** & \
\begin{tabular}{c} **Detectable** \\ **by LogInjector** \\ \end{tabular} &
\begin{tabular}{c} **Vulnerability** \\ **Type** \\ \end{tabular} & **VUL-ID** \\ \hline PHPFusion 9.03.20 & Yes & XSS & CNVD-2022-48580 \\ \hline AbanteCart 1.3.2 & Yes & RCE & CNVD-2022-48600 \\ \hline MaxSite CMS v108 & Yes & RCE & CNVD-2022-51198 \\ \hline SuiteCRM 7.11.23 & Yes & RCE & CNVD-2022-51165 \\ \hline osCommerce 2.3.4.1 & Yes & RCE & CNVD-2022-48592 \\ \hline CE Phoenix 1.0.8.14 & Yes & RCE & CNVD-2022-48597 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Zero-day log injection vulnerabilities discovered by LogInjector. mutation operation mentioned in Section 5.3.5 as the current test case and repeats the above process until a vulnerability is detected or the number of tests reaches the threshold. Note that although we have identified the log-injectable interfaces and the view-logs interfaces, we cannot determine whether the possible vulnerability is a cross-site scripting execution or a remote code-execution vulnerability.