2 ms·

Here's a very, very similar exploit from last year... in a popular enterprise Java stack: http://websec.wordpress.com/2012/01/04/multiple-vulnerabilities-in-ap

by bri3d 14y ago

Here's a very, very similar exploit from last year... in a popular enterprise Java stack: http://websec.wordpress.com/2012/01/04/multiple-vulnerabilities-in-apache-struts2-and-property-oriented-programming-with-java/ http://websec.wordpress.com/2012/01/04/multiple-vulnerabilit...

pacala 14y ago
> The value of a parameter id was reflected to the HTTP response The link you posted illustrates that it is unfortunate that Java supports reflection, and even more unfortunate that various "enterprise" software stacks abuse reflection in ever more creative ways. Stay away of Java reflection and/or use C/C++, and you'll avoid this kind of vulnerabilities.