Code Injection (Php://input Wrapper)

critical Web Application Scanning Plugin ID 98121



Code Injection (Php://input Wrapper)


A modern web application will be reliant on several different programming languages.

These languages can be broken up in two flavours. These are client-side languages (such as those that run in the browser -- like JavaScript) and server-side languages (which are executed by the server -- like ASP, PHP, JSP, etc.) to form the dynamic pages (client-side code) that are then sent to the client.

Because all server-side code should be executed by the server, it should only ever come from a trusted source.

Code injection occurs when the server takes untrusted code (ie. from the client) and executes it.

Cyber-criminals will abuse this weakness to execute arbitrary code on the server, which could result in complete server compromise.

Scanner was able to inject specific server-side code via a PHP wrapper (`php://input`) and have the executed output from the code contained within the server response. This indicates that proper input sanitisation is not occurring.


It is recommended that untrusted input is never processed as server-side code.
To validate input, the application should ensure that the supplied value contains only the data that are required to perform the relevant action.
For example, where a username is required, then no non-alpha characters should not be accepted.

See Also

Plugin Details

Severity: Critical

ID: 98121

Type: remote

Published: 3/31/2017

Updated: 1/26/2022

Scan Template: pci, api, scan

Risk Information


Risk Factor: High

Score: 8.4


Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: Tenable


Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: Tenable

Reference Information