Improper input validation: Difference between revisions

Revision as of 17:32, 22 February 2011

Latest revision as of 02:39, 24 November 2022

(18 intermediate revisions by 12 users not shown)

Line 1:

'''Improper input validation'''<ref name=":0">{{cite web |work=[[Common Weakness Enumeration]] |publisher=[[MITRE]] |title=CWE-20: Improper Input Validation |url=http://cwe.mitre.org/data/definitions/20.html |date=December 13, 2010 |accessdate=February 22, 2011}}</ref> or '''unchecked user input''' is a type of [[vulnerability (computing)|vulnerability]] in [[computer software]] that may be used for [[security exploit]]s.<ref name=hacking>{{cite book|title=Hacking: the art of exploitation|series=No Starch Press Series|publisher=Safari Books Online|first=Jon|last=Erickson|edition=2, illustrated|year=2008|ISBN= 978-1-59327-144-2}}</ref> This vulnerability is caused when "[t]he product does not validate or incorrectly validates input that can affect the control flow or data flow of a program."<ref name=":0" />

<!-- Please do not remove or change this AfD message until the issue is settled -->

{{Article for deletion/dated|page=String exploits|timestamp=20110219225246|year=2011|month=February|day=19|substed=yes}}

<!-- For administrator use only: {{Old AfD multi|page=String exploits|date=19 February 2011|result='''keep'''}} -->

<!-- End of AfD message, feel free to edit beyond this point -->

{{Notability|date=March 2008}}

A '''string exploit''' is a [[security exploit]] involving handling of [[String (computer science)|string]] data in computer software.<ref name=hacking>{{cite book|title=Hacking: the art of exploitation|series=No Starch Press Series|publisher=Safari Books Online|first=Jon|last=Erickson|Edition=2, illustrated|year=2008|ISBN= 9781593271442}}</ref>

This type of exploit is also known as '''Unchecked user input''' or '''Improper input validation'''.<ref>{{cite web |work=[[Common Weakness Enumeration]] |publisher=[[MITRE]] |title=CWE-20: Improper Input Validation |date=December 13, 2010 |accessdate=February 22, 2011}}</ref>

Examples include:

* [[Format string attack]]

* [[Buffer overflow]]

* [[Cross-site scripting]]

* [[Directory traversal]]

* [[Null byte injection]]

* [[SQL injection]]

* [[Uncontrolled format string]]

* [[Null character|Asciiz exploit]]<ref>

{{cite web

| url = http://www.emagined.com/securityfocus-advisory/22831/mod-security-asciiz-byte-post-bypass-vulnerability

| title = Network security advisories article: Mod_Security ASCIIZ byte POST bypass Vulnerability

| date = July 15, 2008

| publisher = Emagined Security

| accessdate = February 22, 2011

}}

</ref>

== References ==

{{reflist}}

{{security-software-stub}}

{{DEFAULTSORT:String Exploits}}

[[Category:Computer security exploits]]