0

A web scan by ZAP indicated that my website is vulnerable to a Remote OS command injection. Details are below:

This is the URL the scanner found vulnerable:

https://[redacted]/[redacted]?address=ZAP%22%26sleep+15%26%22&email=foo-bar%40example.com&message=&name=ZAP&phone=9999999999

This is the exploit:

ZAP"&sleep 15&"

Is this considered a true exploit or just a false positive?

2
  • What happens when you visit the url?
    – nobody
    Dec 17 '20 at 6:15
  • Nothing happened.
    – sanba06c
    Dec 17 '20 at 6:24
2

In my case every time I see this vulnerability it is false positive, this command is "sleep", so if the response long, and takes approximately 15 seconds, which can happen for various reasons (network problems, VPN problems) OWASP ZAP return this as vulnerability.

You should run this request several times and see if every response takes approximately 15 seconds, if not, I would classify this as false positive.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.