Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In Tangled Web Michal Zalewski says:

If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature.

He gave only one example of this vulnerability. There HTTP response of downloaded file contained Content-Type: image/jpeg and Content-Disposition: attachment. Url to file (supplied by an attacker) contained hello.exe. As the result IE saved file to disk as hello.exe.

What are other attacks that use turned on PATH_INFO exist?

share|improve this question
up vote 1 down vote accepted

PATH_INFO is an attacker controlled variable and there for can be the source of tainted data. This variable should never be trusted and a web application must be vary careful not to use this when manipulating files (directory traversal) or printed to the browser (XSS).

An example of an attacker controlling this variable can be seen with this url:

In terms of non-injection attacks, I used this property of PATH_INFO to bypass Wordpress's Access Control System. They where foolish enough to look for the word "admin" in the PATH_INFO variable to check if you where an administrator.

share|improve this answer
Your first url is broken – Ferrybig Jun 1 at 18:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.