Argument Injection or Modification

Revision as of 17:42, 5 September 2008 by KirstenS (talk | contribs) (Example 1)

Jump to: navigation, search
This is an Attack. To view all attacks, please see the Attack Category page.

ASDR Table of Contents

Last revision (mm/dd/yy): 09/5/2008


Argument Injection or Modification is a type of Injection attack. Modifying or injecting data as an argument may lead to very similar, often the same, results as in other injection attacks. It makes no difference if the attacker wants to inject the system command into arguments or into any other part of the code.

Risk Factors


Example 1

Knowing pseudo code of the application, the attacker may guess what action is required by the application to perform another one, for example, what must be done to authorize the attacker as the administrator.

Reading the code below the attacker doesn't know the values of $pass and $login. The question is - is there possiblity of altering value of $authorized not knowing previously mentioned variables?


if($pass = "XXX" and $login = "XXX") { $authorized = 1; }
if($authorized == 1) { admin_panel(); }

If server configuration allows for that, we may try to pass argument $authorized=1 as input data to application.

E.g. /index.php?user=&pass=&authorized=1

Example 2

If security mechanism doesn't protect data as it should, e.g. doesn't check the identity of the user and private data are displayed to him despite of fact they shouldn't, then such user may try to alter arguments and get access to data owned by a different user.

E.g. By entering address user is able to check one of his invoices. Modifying "invoice" argument, considering above assumptions, the attacker may try to access other user's invoices. Usefull to the attacker in this example would be performing a brute-force attack.

Related Threat Agents

Related Attacks

Related Vulnerabilities

Related Controls

  • validation of the format / expected classes of charachetrs / input/output data size