During a penetration test I noticed that changing some of the HTTP GET parameters from expected strings to arrays using
?test=1 instead of
?test=1. In PHP this results either way in an error or in an unwanted Array to String conversion. Which (when errors are suppressed) results in the string "Array".
Does this introduce any security risk? Other than the tiny "risk" that it might give insight in used technology (PHP). Which is also detectable in a lot of different ways.
I once saw a similar case wherein the injection of a deep multidimensional array
?test=1 (times 100), resulted in a rapid exhaustion of resources (denial of service) since a recursive function started to process all that.