note 109188 deleted from security by googleguy

Note Submitter: Lionel ---- Features for manipulation of input data: - Additional or lack of form variables It will send only pass variables from a form provided by the attacker set and not all the form variables like the real thing. BSP: <form ...> <input name="name"> <input name="password"> <input name="optional"> $ _POST ['Name'] = "root"; $ _POST ['Password'] = "12345"; $ _POST ['Optional'] would be missing - Session ID does not match the standard Session ID is guessed or tried themselves together, making it too short or contains incorrect characters BSP: http://www.example.com/?sid=ABCDabcd1234 instead of http://www.example.com/?sid=ABCD% 2Cabcd-1234 - Hidden, select, checkbox variables do not correspond to the model The transmitted values ​​are different from the predefined values ​​of the above fields BSP: <select name="auswahl"> <option value="1"> One </ option> <option value="2"> Two </ option> <option value="3"> Three </ option> </ select> $ _POST ['Selection'] = 'a'; No integer value - Source of variables (get, post, cookie) do not match The attacker tries to parameter passing some variables to set or influence BSP: http://example.com/?login=true $ _GET ['Login'] = true instead of $ _COOKIE ['Login'] = true