Questions tagged [el-injection]

Expression Language Injection (EL-injection or ELI) is an attack where poorly sanitized user input is fed to the Java Unified Expression Language interpreter and injected into a webpage.

Filter by
Sorted by
Tagged with
0 votes
1 answer
513 views

Clarification about PrimeFaces Expression Language Injection

The PrimeFaces Expression Language Injection explained here: http://blog.mindedsecurity.com/2016/02/rce-in-oracle-netbeans-opensource.html Will happy for the clarification about the remediation: Why ...
user avatar
  • 1,457
4 votes
0 answers
2k views

Calling methods with Expression Language Injection in Spring Framework?

I'm currently on a pentest and I've come across a URL parameter which is vulnerable to Expression Language (EL) injection and I can prove that by accessing properties such as ${pageContext}. However, ...
user avatar