DerScanner
Home / Vulnerability Database / C-sharp : Resource injection
C#

C-sharp : Resource injection

Classification

OWASP Top 10 2013
A1-InjectionA4-Insecure Direct Object References
OWASP Top 10 2017
A1-Injection
OWASP Top 10 2021
A3-Injection
OWASP ASVS
Validation, Sanitization and Encoding
PCI DSS 4.0
6.2.4
CWE
CWE-1027CWE-1030

Overview

Using data from an untrusted source to identify the resource allows an attacker to view or modify protected system resources.

The injection when working with resources (resource injection) occurs when an attacker can specify the identifier to access the system resources (for example, the port number for the network resource access). This allows him/her in particular to transfer valuable data to a third party server.

References

  1. OWASP Top 10 2017-A1-Injection
  2. OWASP Top 10 2013-A1-Injection
  3. OWASP Top 10 2013-A4-Insecure Direct Object References
  4. CWE-99: Improper Control of Resource Identifiers (‘Resource Injection’)
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A1 - Injection
  6. CWE-1030
MEDIUM

DerScanner Severity Score

Do you want to fix C-sharp : Resource injection in your application?

See also

C#

C-sharp : JWT: None Algorithm

C#

C-sharp : Insecure data transmission: Database

C#

C-sharp : Only one of method Equals() and GetHashCode() defined