# LogInjector: Detecting Web Application Log Injection Vulnerabilities
## 6 Evaluation
### Comparison with Existing Work  
In this section, we compare and analyze LogInjector with Black Widow [29]. We choose Black Widow because currently only Black Widow has the ability to detect a subset of log injection vulnerabilities automatically and it has open-source code. Black Widow adopts the method of a black box dynamic crawler by inputting random strings in each input box and matching these strings in subsequent web pages to analyze the web application's inter-state dependencies. Then, it performs vulnerability detection. We use LogInjector and Black Widow to detect the 16 log injection vulnerabilities in the second column of Table 7. The experimental results are shown in Table 7. We enumerate the detection capabilities of LogInjector and Black Widow for these 16 log injection vulnerabilities. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Vulnerability Type** & **VUL-ID** & **Web Application** & **LogInjector** & **Black Widow** \\ \hline \multirow{8}{*}{XSS} & CVE-2021-35210 & Contao 4.9.5 & ✓ & ✗ \\ \cline{2-5}  & CVE-2020-8820 & \multirow{2}{*}{webmin 1.941} & ✓ & ✗ \\ \cline{2-5}  & CVE-2020-8821 & & ✓ & ✗ \\ \cline{2-5}  & CVE-2021-24294 & DSGVO All in one for WP 3.9 & ✓ & ✓ \\ \cline{2-5}  & CVE-2021-25115 & WP Photo Album Plus 8.0.9 & ✓ & ✗ \\ \cline{2-5}  & CVE-2022-0230 & BWP Google XML Sitemaps 1.4.1 & ✓ & ✓ \\ \cline{2-5}  & CVE-2022-0706 & easy-digital-downloads 2.11.5 & ✓ & ✓ \\ \cline{2-5}  & CVE-2020-17449 & \multirow{2}{*}{PHPFusion 9.03.20} & ✓ & ✗ \\ \cline{2-5}  & CNVD-2022-48580 & & ✓ & ✗ \\ \hline \multirow{8}{*}{**RCE**} & CVE-2017-11675 & ZenCart 1.5.5e & ✓ & ✗ \\ \cline{2-5}  & CVE-2021-42840 & SuiteCRM 7.11.19 & ✓ & ✗ \\ \cline{2-5}  & CNVD-2022-51165 & SuiteCRM 7.11.23 & ✓ & ✗ \\ \cline{2-5}  & CNVD-2022-51198 & MaxSite CMS v108 & ✓ & ✗ \\ \cline{2-5}  & CNVD-2022-48600 & AbanteCart 1.3.2 & ✓ & ✗ \\ \cline{2-5}  & CNVD-2022-48592 & osCommerce 2.3.4.1 & ✓ & ✗ \\ \cline{2-5}  & CNVD-2022-48597 & CE Phoenix 1.0.8.14 & ✓ & ✗ \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Vulnerability Detection Capability Comparison. As shown in Table 7, LogInjector detected a total of 16 log injection vulnerabilities, including 9 cross-site scripting vulnerabilities and 7 remote code-execution vulnerabilities. Black Widow detected a total of three log injection vulnerabilities, all of which are cross-site scripting vulnerabilities. Because Black Widow cannot detect remote code-execution vulnerabilities, we mainly analyzed the reasons why Black Widow did not detect the remaining six cross-site scripting vulnerabilities, which can be summarized as the following three:  
1. The input constructed by Black Widow cannot be written to the log;
2. The set of test cases injected by Black Widow is limited, and even if the log is written, it does not have execution semantics. The injected data cannot be executed;
3. Black Widow injected a payload with code execution semantics, but did not identify the view-logs interface and failed to trigger the vulnerability. The results of our analysis of these six vulnerabilities are shown in Table 8. Taking Reason-2 as an example, we can see that two web applications corresponding to the Reason-2 row in the Table 8 both perform different input filtering on user input. Due to Black Widow's fixed set of test cases, the injected data are encoded or replaced and cannot be executed. Thanks to our proposed dynamic testing method based on feedback-guided mutations, LogInjector can mutate test cases based on feedback in logs as well as in HTML responses and finally enter an effective payload. The comparative experimental results prove the challenges of using black-box detection methods to detect such vulnerabilities. This result is similar to those of previous studies [21; 22; 23; 24; 48]. For special scenarios, such as the Reason-2 row in Table 8, blindly traversing the input test cases cannot trigger the vulnerability.