DPSSX: Detecting and Preventing SQLi and Stored XSS Induced by Expressions in Web Application SQL Statements via Static-Dynamic Analysis

Abstract

Injection vulnerabilities in SQL statements (e.g., SQLi and stored XSS) critically threaten web applications. Existing detection methods—source-origin-based, structure-based, and variable/rule-based—struggle when SQL statements contain arithmetic or function expressions, resulting in high false positives. To overcome this, we propose DPSSX, an automated detection and prevention prototype leveraging static and dynamic analysis to Detect and Prevent SQLi and Stored XSS attacks triggered by expressions in SQL statements. DPSSX first applies static analysis to locate SQL statements, identify data sources (POST, sessions, databases, etc.), and flag variables in arithmetic/function expressions that may alter attack impact. A dynamic global HTTP request extractor then collects comprehensive inputs for complex applications. Using a joint attack engine, DPSSX injects payloads covering the latest attack patterns. Through proxy-based execution, it captures SQL queries containing payloads or expressions. An expression pre-execution module computes results to mitigate false positives from expression-based neutralization/amplification. By matching query data against attack-pattern rules, DPSSX detects first/second-order SQL injection and stored XSS attacks and sanitizes malicious inputs using character escaping, truncation, unified decoding, and malicious keyword blocking. In our evaluation, using five attack generators to produce 120,495 SQL injection attacks and 3,763 XSS attacks, DPSSX successfully identified 441 first-order SQL injection vulnerabilities, 28 second-order SQL injection vulnerabilities, and 101 stored XSS vulnerabilities across 20 well-known open-source web applications. Additionally, DPSSX achieved 100% elimination of malicious effects on data with negligible overhead.