Web Application Vulnerabilities

SQL injection happens when untrusted input is concatenated into a query, letting an attacker alter its structure — bypass auth, dump data, even run commands. The defense is parameterized queries: data travels separately from SQL, so input cannot change it. Least privilege limits the damage.

XSS injects attacker JavaScript into a page that runs in the victim's browser, stealing sessions or acting as them. The primary defense is context-aware output encoding of untrusted data, backed by a Content Security Policy. httpOnly/secure flags reduce cookie theft but don't stop XSS.

OS command injection — domain goes into a shell string with shell=True, so shell metacharacters run arbitrary commands (RCE). Fix: shell=False with an argument list, keeping input one argument, plus hostname validation.

CSRF tricks a logged-in victim's browser into sending a forged state-changing request. POST /pay is exploitable only if the session rides in a cookie auto-sent cross-site, there is no anti-CSRF token, and the cookie lacks SameSite. Tokens and SameSite=Lax close it.

Path traversal — fileName is concatenated into the path unchecked, so ../ sequences climb out of open-media/ and read arbitrary files. Fix: normalize the resolved path and verify it stays inside the base directory, or map requests to an allowlist of filenames.

SSRF tricks the server into fetching an attacker-chosen URL, reaching internal services or cloud metadata the client cannot. Blocklists of localhost fall to alternate IP forms, open redirects, TOCTOU gaps, and DNS rebinding. Defend by validating the final resolved IP against an allowlist.

SQL injection — text() runs the concatenated f-string verbatim instead of parameterizing it, so table_name injects arbitrary SQL. Blind because nothing returns; only response timing confirms execution. Fix: bound parameters and an allowlist.

Insecure deserialization — readObject instantiates arbitrary attacker-chosen classes from untrusted bytes, so a gadget chain of library classes runs code during deserialization (RCE). Fix: do not deserialize untrusted input; use JSON with an explicit schema or a class allowlist.

DOM XSS: any window can post {type:'go_to_link', url:'javascript:alert(1)'} and the handler runs it via location.assign, executing script. Two flaws: no event.origin allowlist and no URL-scheme validation. Fix: check e.origin against a trusted list, then accept only http/https URLs (reject javascript:/data:) before navigating.

Local File Read — readfile($url) serves any path, so a php://filter wrapper reads arbitrary files. The mime gate is bypassed because a filter chain can re-encode the leading bytes until getimagesize() accepts them as an image, or via TOCTOU between check and read. Fix: allowlist sources, block php://, download once, re-encode server-side.

NoSQL injection via incorrect type handling — username is never coerced to a string, so an attacker sends an object of MongoDB operators that changes query semantics and bypasses the lookup. Fix: cast to a string and query an explicit field instead of passing the raw request object.

Yes — literal() is a raw SQL escape hatch; the ORM does NOT parameterize text inside it. The :firstName binding is only substituted by string replacement, and on an outdated version a crafted firstName (and lastName set to :firstName) breaks out of the literal and injects SQL. Fix: never put user input near literal(); rely on the ORM's parameterized where operators and upgrade the library.

Server-side template injection — name becomes part of the template source, and escapeHTML only neutralizes HTML, not template syntax. Any ${...} expression is compiled and executed server-side, giving RCE. Fix: pass name as data to a fixed template, never build the template from input.

Alias path traversal from the missing trailing slash on the location. Because /assets has no trailing slash, nginx appends the URI part after /assets to the alias as-is, so /assets../app/db.php resolves to /var/www/webapp/app/db.php — one level above static/. Fix: give both the location and the alias a trailing slash.

A target="_blank" link gives the opened page a window.opener reference back to yours, letting it redirect your page to a phishing clone (reverse tabnabbing). rel="noopener" severs that reference. rel="noreferrer" additionally strips the Referer header, hiding the source URL.

A TOCTOU race: read-check-write isn't atomic, so concurrent requests read the same balance, all pass the >= check, and each debits — the attacker spends far more than they have. Fix: make it atomic — a transaction with row-level (pessimistic) locking, or one conditional update (UPDATE ... SET balance = balance - :amt WHERE balance >= :amt).

xlsx/docx are ZIP archives of XML, so attack surface is large. Attacks: Zip Slip — a crafted archive path escapes the extraction dir; XXE — external entities in the XML reach files/SSRF; CSV injection — a cell like =cmd|... executes on open; macros; library CVEs. Defend by validating paths, disabling external entities and macros, sandboxing, and patching.