DerScanner
Home / Vulnerability Database / PHP : LDAP injection
PHP

PHP : LDAP injection

Classification

OWASP Top 10 2013
A1-Injection
OWASP Top 10 2017
A1-Injection
OWASP Top 10 2021
A3-Injection
OWASP ASVS
Validation, Sanitization and EncodingValidation, Sanitization and Encoding
PCI DSS 4.0
6.2.4
HIPAA
§164.312 (c)(1)§164.312 (c)(2)
CWE
CWE-90CWE-1027

Overview

LDAP query injection is possible. This can lead to data confidentiality loss or to data modification.

Injection vulnerabilities take the first place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

LDAP is an application-level protocol for accessing and maintaining distributed directory information services (X.500 directory service). If LDAP query is based on data from an untrusted source (e.g., user input) and the data do not pass validation, an attacker can modify the query and execute it with the application rights.

The application creates an LDAP query generated based on data from an untrusted source that has not been validated. This allows an attacker to change the semantics of the query.

References

  1. OWASP Top 10 2017-A1-Injection
  2. WASC-29: LDAP Injection
  3. CWE-90: Improper Neutralization of Special Elements used in an LDAP Query
  4. LDAP Injection Guide: Learn How to Detect LDAP Injections and Improve LDAP Security
  5. OWASP: LDAP Injection
  6. CWE CATEGORY: OWASP Top Ten 2017 Category A1 - Injection
MEDIUM

DerScanner Severity Score

Do you want to fix PHP : LDAP injection in your application?

See also

PHP

PHP : Null salt

PHP

PHP : Empty password

PHP

PHP : Empty salt