Description
OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using multipart encoded requests instead of form-urlencoded requests. NOTE: this might be used to expose vulnerabilities in applications that would otherwise be protected by the validation routines.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- OWASP Stinger - Filter Bypass EDB-30491 · remote · Aug 13, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20070813 [o0o] Bypassing servlet input validation filters (OWASP Stinger + Struts example) mailing-list
- 26441 third-party-advisory
- owasp-stinger-multipart-security-bypass(35981) vdb-entry
- 3035 third-party-advisory
- 39544 vdb-entry
- 1018555 vdb-entry
- http://o0o.nu/~meder/o0o_bypassing_servlet_input_validation_filters.txt
- 25294 vdb-entry