Name HTTP Parameter Pollution (HPP)
Summary An attacker overrides or adds HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.
Prerequisites HTTP protocol is used with some GET/POST parameters passed
Solutions Implementation: Beware of multiple occurrences of a parameter in a Query String
Related Weaknesses
CWE ID Description
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-147 Improper Neutralization of Input Terminators
CWE-235 Improper Handling of Extra Parameters
Back to Top