This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Top 10 2013-A1-Injection"
From OWASP
| Line 5: | Line 5: | ||
|year=2013}} | |year=2013}} | ||
|useprev=2013PrevLink | |useprev=2013PrevLink | ||
| − | |prev= | + | |prev={{Top_10_2010:ByTheNumbers |
| + | |1 | ||
| + | |year=2013}} | ||
}} | }} | ||
| Line 21: | Line 23: | ||
{{Top_10_2010:SummaryTableEndTemplate}} | {{Top_10_2010:SummaryTableEndTemplate}} | ||
| − | + | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=1|risk=2|year=2013}} | |
| − | + | blank | |
| − | + | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=2|risk=2|year=2013}} | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | {{Top_10_2010:SubsectionAdvancedTemplate | ||
blank | blank | ||
#blankBullet1 | #blankBullet1 | ||
#blankBullet2 | #blankBullet2 | ||
| − | + | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=3|risk=2|year=2013}} | |
| − | + | blank | |
| − | + | {{Top_10_2010:ExampleBeginTemplate}}<span style="color:red;">blank code</span>{{Top_10_2010:ExampleEndTemplate}} | |
| − | |||
| − | |||
blank | blank | ||
{{Top_10_2010:ExampleBeginTemplate}}<nowiki>http://example.com/app/accountView?id=</nowiki><span style="color: red;">' or '1'='1</span>{{Top_10_2010:ExampleEndTemplate}} | {{Top_10_2010:ExampleBeginTemplate}}<nowiki>http://example.com/app/accountView?id=</nowiki><span style="color: red;">' or '1'='1</span>{{Top_10_2010:ExampleEndTemplate}} | ||
blank | blank | ||
| − | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=4|risk= | + | {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|number=4|risk=2|year=2013}} |
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}} | {{Top_10_2010:SubSubsectionOWASPReferencesTemplate}} | ||
* [[SQL_Injection_Prevention_Cheat_Sheet | OWASP SQL Injection Prevention Cheat Sheet]] | * [[SQL_Injection_Prevention_Cheat_Sheet | OWASP SQL Injection Prevention Cheat Sheet]] | ||
| Line 56: | Line 50: | ||
|year=2013}} | |year=2013}} | ||
|useprev=2013PrevLink | |useprev=2013PrevLink | ||
| − | |prev= | + | |prev={{Top_10_2010:ByTheNumbers |
| − | }} | + | |1 |
| + | |year=2013}}}} | ||
[[Category:OWASP Top Ten Project]] | [[Category:OWASP Top Ten Project]] | ||
Revision as of 20:37, 16 February 2013
NOTE: THIS IS NOT THE LATEST VERSION. Please visit the OWASP Top 10 project page to find the latest edition.
| [[Top 10 {{{year}}}-Injection|← Injection]] | [[Top_10_{{{year}}}-Top 10|{{{year}}} Top 10 List]] |
[[Top 10 {{{year}}}-Broken Authentication and Session Management|Broken Authentication and Session Management →]] |
| Threat Agents | Attack Vectors | Security Weakness | Technical Impacts | Business Impacts | |
|---|---|---|---|---|---|
| Application Specific | Exploitability EASY |
Prevalence COMMON |
Detectability AVERAGE |
Impact SEVERE |
Application / Business Specific |
| blank. | blank | blank | blank | blank | |
|
Am I Vulnerable To 'Broken Authentication and Session Management'?
blank |
How Do I Prevent 'Broken Authentication and Session Management'?
blank
|
|
Example Attack Scenarios
blank blank code
blank http://example.com/app/accountView?id=' or '1'='1
blank |
References
OWASP External |
| [[Top 10 {{{year}}}-Injection|← Injection]] | [[Top_10_{{{year}}}-Top 10|{{{year}}} Top 10 List]] |
[[Top 10 {{{year}}}-Broken Authentication and Session Management|Broken Authentication and Session Management →]] |
