inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

learn more… | top users | synonyms

5
votes
1answer
1k views

Code Review on a Header Injection In Java : any help?

I'm auditing a piece of Java code that might be vulnerable to header injection : String headerValue =request.getParameter("headerVal"); //escaping CRLF headerValue = headerValue.replace("\n", ""); ...
0
votes
1answer
601 views

can the value of request.getHeader(“Host”) be faked?

Suppose if there is some code like <a href="<%=request.getHeader("Host")%>/xxx/abc.do>SignIn</a> Can an attacker fake request.getHeader("host") to point 'SignIn' anchor to ...
6
votes
1answer
665 views

Yahoo! Messenger injection attack

Just five minutes ago I had an injection attack through Yahoo! Messenger. The only visible effect was the change of my status message. I also got a dialog message saying that a script cannot continue ...
5
votes
4answers
1k views

Server wide javascript injection

UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript. I'm troubleshooting a hacked website ...
20
votes
4answers
35k views

How to inject executable, malicious code into PDF, JPEG, MP3, etc.?

I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application? And if so, how would one do ...
17
votes
2answers
603 views

What risks should I be aware of before allowing advertisements being placed on my website?

The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site. Does serving ...
3
votes
1answer
120 views

Attacker reinjecting form options?

I take form input all over my site, and use query parameters to sanitize data. When an invalid data type is passed, a simple (not detailed) notice is thrown and I receive an email with what was ...
4
votes
2answers
167 views

What perils are there in allowing user input of parts of an ODBC connect string?

I'm developing an application that allows user to input hostnames, database names, usernames, and passwords for database access. The application will construct a ODBC connect string by filling in the ...
5
votes
3answers
7k views

Testing PHP form injection

I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input: if( $_POST["var"] != "" ) { print ...
6
votes
2answers
709 views

GET with additional parameters leads to “code injection” in html displayed

We got a security review done of our PHP code and the security company sent this in their report: Request GET ...
7
votes
3answers
1k views

PHP mail() Header Injection Prevention

This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
2
votes
2answers
778 views

Is it possible to take down a site using javascript in the URL bar?

If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?