To perform specific actions from within a web application, it is occasionally required to run Operating System commands and have the output of these commands captured by the web application and returned to the client.

OS command injection occurs when user supplied input is inserted into one of these commands without proper sanitisation and is then executed by the server.

Cyber-criminals will abuse this weakness to perform their own arbitrary commands on the server. This can include everything from simple `ping` commands to map the internal network, to obtaining full control of the server.

By injecting OS commands that take a specific amount of time to execute, scanner was able to detect time based OS command injection. This indicates that proper input sanitisation is not occurring.

OS command injection occurs when user supplied input is used to form a command to be executed by the operating system.

Scanner was able to inject specific Operating System commands and have the output from that command contained within the server response. This indicates that input is not being sanitized properly.

A modern web application will be reliant on several different programming languages.

These languages can be broken up in two flavours. These are client-side languages (such as those that run in the browser -- like JavaScript) and server-side languages (which are executed by the server -- like ASP, PHP, JSP, etc.) to form the dynamic pages (client-side code) that are then sent to the client.

Because all server-side code should be executed by the server, it should only ever come from a trusted source.

Code injection occurs when the server takes untrusted code (ie. from the client) and executes it.

Cyber-criminals will abuse this weakness to execute arbitrary code on the server, which could result in complete server compromise.

By injecting server-side code that is known to take a specific amount of time to execute, scanner was able to detect time-based code injection. This indicates that proper input sanitisation is not occurring.

A modern web application will be reliant on several different programming languages.

These languages can be broken up in two flavours. These are client-side languages (such as those that run in the browser -- like JavaScript) and server-side languages (which are executed by the server -- like ASP, PHP, JSP, etc.) to form the dynamic pages (client-side code) that are then sent to the client.

Because all server-side code should be executed by the server, it should only ever come from a trusted source.

Code injection occurs when the server takes untrusted code (ie. from the client) and executes it.

Cyber-criminals will abuse this weakness to execute arbitrary code on the server, which could result in complete server compromise.

Scanner was able to inject specific server-side code via a PHP wrapper (`php://input`) and have the executed output from the code contained within the server response. This indicates that proper input sanitisation is not occurring.

A modern web application will be reliant on several different programming languages.

These languages can be broken up in two flavours. These are client-side languages (such as those that run in the browser -- like JavaScript) and server-side languages (which are executed by the server -- like ASP, PHP, JSP, etc.) to form the dynamic pages (client-side code) that are then sent to the client.

Because all server-side code should be executed by the server, it should only ever come from a trusted source.

Code injection occurs when the server takes untrusted code (ie. from the client) and executes it.

Cyber-criminals will abuse this weakness to execute arbitrary code on the server, which could result in complete server compromise.

Scanner was able to inject specific server-side code and have the executed output from the code contained within the server response. This indicates that proper input sanitisation is not occurring.

ID	Name	Severity
98124	Operating System Command Injection (Timing Attack)	critical
98123	Operating System Command Injection	critical
98122	Code Injection (Timing Attack)	critical
98121	Code Injection (Php://input Wrapper)	critical
98120	Code Injection	critical

Detections

Analytics

Code Execution Family for Web App Scanning

critical

critical

critical

critical

critical