Parameter Delimiter - Revision history

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-06-03T12:50:48Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 02:21, 31 May 2009

2009-05-31T02:21:54Z

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-05-29T18:00:28Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 16:43, 29 May 2009

2009-05-29T16:43:36Z

MediaWiki spam cleanup: Reverting to last version not containing links to www.textzelrelba.com

2009-05-27T18:31:09Z

Reverting to last version not containing links to www.textzelrelba.com

MediaWiki spam cleanup: Reverting to last version not containing links to s1.shard.jp

2009-05-27T16:00:38Z

Reverting to last version not containing links to s1.shard.jp

Deleted user at 12:10, 26 May 2009

2009-05-26T12:10:14Z

Deleted user at 19:59, 22 May 2009

2009-05-22T19:59:39Z

KirstenS at 11:47, 23 April 2009

2009-04-23T11:47:21Z

KirstenS at 22:18, 7 April 2009

2009-04-07T22:18:43Z

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
 <br>
@@ Line 16: / Line 15: @@
 In order to illustrate this vulnerability, we will use a vulnerability found on Poster V2, a posting system based on PHP programming language.
-This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in âmem.phpâ file, which is responsible for managing the application user.
+This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in “mem.php” file, which is responsible for managing the application user.
-An example of the file âmem.phpâ, where user Jose has admin privileges and Alice user access:
+An example of the file “mem.php”, where user Jose has admin privileges and Alice user access:
   <?
@@ Line 25: / Line 24: @@
   ?>
-When a user wants to edit his profile, he must use the "edit accountâ option in the âindex.phpâ page and enter his login information. However, using â|â as a parameter delimiter on email field followed by âadminâ, the user could elevate his privileges to administrator. Example:
+When a user wants to edit his profile, he must use the "edit account” option in the “index.php” page and enter his login information. However, using “|” as a parameter delimiter on email field followed by “admin”, the user could elevate his privileges to administrator. Example:
   Username: Alice
@@ Line 31: / Line 30: @@
   Email: alice@attack.com |admin|
-This information will be recorded in âmem.phpâ file like this:
+This information will be recorded in “mem.php” file like this:
   Alice|87654321|alice@attack.com|admin|normal|
-In this case, the last parameter delimiter considered is â|admin|â and the user could elevate his privileges by assigning administrator profile.
+In this case, the last parameter delimiter considered is “|admin|” and the user could elevate his privileges by assigning administrator profile.
-Although this vulnerability doesnât allow manipulation of other users' profiles, it allows privilege escalation for application users.
+Although this vulnerability doesn’t allow manipulation of other users' profiles, it allows privilege escalation for application users.
 ==Related [[Threat Agents]]==

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
 <br>
@@ Line 15: / Line 16: @@
 In order to illustrate this vulnerability, we will use a vulnerability found on Poster V2, a posting system based on PHP programming language.
-This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in “mem.php” file, which is responsible for managing the application user.
+This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in âmem.phpâ file, which is responsible for managing the application user.
-An example of the file “mem.php”, where user Jose has admin privileges and Alice user access:
+An example of the file âmem.phpâ, where user Jose has admin privileges and Alice user access:
   <?
@@ Line 24: / Line 25: @@
   ?>
-When a user wants to edit his profile, he must use the "edit account” option in the “index.php” page and enter his login information. However, using “|” as a parameter delimiter on email field followed by “admin”, the user could elevate his privileges to administrator. Example:
+When a user wants to edit his profile, he must use the "edit accountâ option in the âindex.phpâ page and enter his login information. However, using â|â as a parameter delimiter on email field followed by âadminâ, the user could elevate his privileges to administrator. Example:
   Username: Alice
@@ Line 30: / Line 31: @@
   Email: alice@attack.com |admin|
-This information will be recorded in “mem.php” file like this:
+This information will be recorded in âmem.phpâ file like this:
   Alice|87654321|alice@attack.com|admin|normal|
-In this case, the last parameter delimiter considered is “|admin|” and the user could elevate his privileges by assigning administrator profile.
+In this case, the last parameter delimiter considered is â|admin|â and the user could elevate his privileges by assigning administrator profile.
-Although this vulnerability doesn’t allow manipulation of other users' profiles, it allows privilege escalation for application users.
+Although this vulnerability doesnât allow manipulation of other users' profiles, it allows privilege escalation for application users.
 ==Related [[Threat Agents]]==

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
 <br>
@@ Line 16: / Line 15: @@
 In order to illustrate this vulnerability, we will use a vulnerability found on Poster V2, a posting system based on PHP programming language.
-This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in âmem.phpâ file, which is responsible for managing the application user.
+This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in “mem.php” file, which is responsible for managing the application user.
-An example of the file âmem.phpâ, where user Jose has admin privileges and Alice user access:
+An example of the file “mem.php”, where user Jose has admin privileges and Alice user access:
   <?
@@ Line 25: / Line 24: @@
   ?>
-When a user wants to edit his profile, he must use the "edit accountâ option in the âindex.phpâ page and enter his login information. However, using â|â as a parameter delimiter on email field followed by âadminâ, the user could elevate his privileges to administrator. Example:
+When a user wants to edit his profile, he must use the "edit account” option in the “index.php” page and enter his login information. However, using “|” as a parameter delimiter on email field followed by “admin”, the user could elevate his privileges to administrator. Example:
   Username: Alice
@@ Line 31: / Line 30: @@
   Email: alice@attack.com |admin|
-This information will be recorded in âmem.phpâ file like this:
+This information will be recorded in “mem.php” file like this:
   Alice|87654321|alice@attack.com|admin|normal|
-In this case, the last parameter delimiter considered is â|admin|â and the user could elevate his privileges by assigning administrator profile.
+In this case, the last parameter delimiter considered is “|admin|” and the user could elevate his privileges by assigning administrator profile.
-Although this vulnerability doesnât allow manipulation of other users' profiles, it allows privilege escalation for application users.
+Although this vulnerability doesn’t allow manipulation of other users' profiles, it allows privilege escalation for application users.
 ==Related [[Threat Agents]]==

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
 <br>
@@ Line 15: / Line 16: @@
 In order to illustrate this vulnerability, we will use a vulnerability found on Poster V2, a posting system based on PHP programming language.
-This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in “mem.php” file, which is responsible for managing the application user.
+This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in âmem.phpâ file, which is responsible for managing the application user.
-An example of the file “mem.php”, where user Jose has admin privileges and Alice user access:
+An example of the file âmem.phpâ, where user Jose has admin privileges and Alice user access:
   <?
@@ Line 24: / Line 25: @@
   ?>
-When a user wants to edit his profile, he must use the "edit account” option in the “index.php” page and enter his login information. However, using “|” as a parameter delimiter on email field followed by “admin”, the user could elevate his privileges to administrator. Example:
+When a user wants to edit his profile, he must use the "edit accountâ option in the âindex.phpâ page and enter his login information. However, using â|â as a parameter delimiter on email field followed by âadminâ, the user could elevate his privileges to administrator. Example:
   Username: Alice
@@ Line 30: / Line 31: @@
   Email: alice@attack.com |admin|
-This information will be recorded in “mem.php” file like this:
+This information will be recorded in âmem.phpâ file like this:
   Alice|87654321|alice@attack.com|admin|normal|
-In this case, the last parameter delimiter considered is “|admin|” and the user could elevate his privileges by assigning administrator profile.
+In this case, the last parameter delimiter considered is â|admin|â and the user could elevate his privileges by assigning administrator profile.
-Although this vulnerability doesn’t allow manipulation of other users' profiles, it allows privilege escalation for application users.
+Although this vulnerability doesnât allow manipulation of other users' profiles, it allows privilege escalation for application users.
 ==Related [[Threat Agents]]==

@@ Line 1: / Line 1: @@
 {{Template:Attack}}
 <br>
@@ Line 16: / Line 15: @@
 In order to illustrate this vulnerability, we will use a vulnerability found on Poster V2, a posting system based on PHP programming language.
-This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in âmem.phpâ file, which is responsible for managing the application user.
+This application has a dangerous vulnerability that allows inserting data into user fields (username, password, email address and privileges) in “mem.php” file, which is responsible for managing the application user.
-An example of the file âmem.phpâ, where user Jose has admin privileges and Alice user access:
+An example of the file “mem.php”, where user Jose has admin privileges and Alice user access:
   <?
@@ Line 25: / Line 24: @@
   ?>
-When a user wants to edit his profile, he must use the "edit accountâ option in the âindex.phpâ page and enter his login information. However, using â|â as a parameter delimiter on email field followed by âadminâ, the user could elevate his privileges to administrator. Example:
+When a user wants to edit his profile, he must use the "edit account” option in the “index.php” page and enter his login information. However, using “|” as a parameter delimiter on email field followed by “admin”, the user could elevate his privileges to administrator. Example:
   Username: Alice
@@ Line 31: / Line 30: @@
   Email: alice@attack.com |admin|
-This information will be recorded in âmem.phpâ file like this:
+This information will be recorded in “mem.php” file like this:
   Alice|87654321|alice@attack.com|admin|normal|
-In this case, the last parameter delimiter considered is â|admin|â and the user could elevate his privileges by assigning administrator profile.
+In this case, the last parameter delimiter considered is “|admin|” and the user could elevate his privileges by assigning administrator profile.
-Although this vulnerability doesnât allow manipulation of other users' profiles, it allows privilege escalation for application users.
+Although this vulnerability doesn’t allow manipulation of other users' profiles, it allows privilege escalation for application users.
 ==Related [[Threat Agents]]==

← Older revision		Revision as of 11:47, 23 April 2009
Line 3:		Line 3:
	[[Category:OWASP ASDR Project]]		[[Category:OWASP ASDR Project]]

		+
		+	Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

	==Description==		==Description==

← Older revision		Revision as of 22:18, 7 April 2009
Line 2:		Line 2:
	<br>		<br>
	[[Category:OWASP ASDR Project]]		[[Category:OWASP ASDR Project]]
−	~~[[ASDR Table of Contents]]~~