Last revision (mm/dd/yy): 05/22/2009
This attack is based on the manipulation of parameter delimiters used by web application input vectors in order to cause unexpected behaviors like access control and authorization bypass and information disclosure, among others.
In order to illustrate this vulnerability, we will use a vulnerability found on Poster V2, a posting system based on PHP programming language.
This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in âmem.phpâ file, which is responsible for managing the application user.
An example of the file âmem.phpâ, where user Jose has admin privileges and Alice user access:
<? Joseemail@example.com|admin| Alicefirstname.lastname@example.org|normal| ?>
When a user wants to edit his profile, he must use the "edit accountâ option in the âindex.phpâ page and enter his login information. However, using â|â as a parameter delimiter on email field followed by âadminâ, the user could elevate his privileges to administrator. Example:
Username: Alice Password: 87654321 Email: email@example.com |admin|
This information will be recorded in âmem.phpâ file like this:
In this case, the last parameter delimiter considered is â|admin|â and the user could elevate his privileges by assigning administrator profile.
Although this vulnerability doesnât allow manipulation of other users' profiles, it allows privilege escalation for application users.