Semantic URL attack


In a semantic URL attack, a client manually adjusts the parameters of its request by maintaining the URL's syntax but altering its semantic meaning. This attack is primarily used against CGI driven websites.
A similar attack involving web browser cookies is commonly referred to as cookie poisoning.

Example

Consider a web-based e-mail application where users can reset their password by answering the security question correctly, and allows the users to send the password
to the e-mail address of their choosing. After they answer the security question correctly, the web page will arrive to the following web form where the users can enter their alternative e-mail address:



Please enter your alternative e-mail address:







The receiving page, resetpassword.php, has all the information it needs to send the password to the new e-mail. The hidden variable username contains the value user001, which is the username of the e-mail account.
Because this web form is using the GET data method, when the user submits alternative@emailexample.com as the e-mail address where the user wants the password to be sent to,
the user then arrives at the following URL:
This URL appears in the location bar of the browser, so the user can identify the username and the e-mail address through the URL parameters. The user may decide to steal other people's e-mail address by visiting the following URL as an experiment:
If the resetpassword.php accepts these values, it is vulnerable to a semantic URL attack. The new password of the user002 e-mail address will be generated and sent to alternative@emailexmaple.com which causes user002's e-mail account to be stolen.
One method of avoiding semantic URL attacks is by using session variables. However, session variables can be vulnerable to other types of attacks such as session hijacking and cross-site scripting.