Parameter Delimiter

australia national flag http map horn of africa services asian pooping automobile tulsa used south african politician open learning australia melbourne automatic cutoff power station norton antivirus downloads free antique asia print links automotive technician schooling pc links australia url auto gps software booty asians plunkett homes australia panda antivirus titanium 2004 keygen before symantec antivirus could be completely installed map africa marine world usa map of sydney nsw australia norton antivirus 2003 software antivirus gratuit online auto cad job norton antivirus corporate edition uninstall australia ministry of tourism webmap malaria east africa hays avg antivirus registration openantivirus australian bull riding great white shark tours south africa asian g girl string download panda antivirus software housecalls antivirus free scan avg antivirus system download auto codecs panda antivirus scan online mountasia family fun center 2006 keygen pro v2.0.205.1 winantivirus africa diode light manufacturer south dr solomons antivirus toolkit airbrush automotive stencils ez antivirus 2005 reviews url south african t 6 australia travel visa the world cruise asian mixed with black girl

Last revision (mm/dd/yy): //

Description
This attack is based on the manipulation of parameter delimiters used by web application input vectors in order to cause unexpected behaviors like access control and authorization bypass and information disclosure, among others.

Risk Factors
TBD

Examples
In order to illustrate this vulnerability, we will use a vulnerability found on Poster V2, a posting system based on PHP programming language.

This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in âmem.phpâ file, which is responsible for managing the application user.

An example of the file âmem.phpâ, where user Jose has admin privileges and Alice user access:

<? Jose|12345678|jose@attack.com|admin| Alice|87654321|alice@attack.com|normal| ?>

When a user wants to edit his profile, he must use the "edit accountâ option in the âindex.phpâ page and enter his login information. However, using â|â as a parameter delimiter on email field followed by âadminâ, the user could elevate his privileges to administrator. Example:

Username: Alice Password: 87654321 Email: alice@attack.com |admin|

This information will be recorded in âmem.phpâ file like this:

Alice|87654321|alice@attack.com|admin|normal|

In this case, the last parameter delimiter considered is â|admin|â and the user could elevate his privileges by assigning administrator profile.

Although this vulnerability doesnât allow manipulation of other users' profiles, it allows privilege escalation for application users.

Related Threat Agents

 * Category: Authorization
 * Category: Command Execution

Related Attacks

 * Category:Injection Attack

Related Vulnerabilities

 * Category: Input Validation Vulnerability

Related Controls

 * Category: Input Validation