CAPEC™ 152: Inject Unexpected Items
Description
Attack patterns within this category focus on the ability to control or disrupt the behavior of a target either through crafted data submitted via an interface for data input, or the installation and execution of malicious code on the target system. The former happens when an adversary adds material to their input that is interpreted by the application causing the targeted application to perform steps unintended by the application manager or causing the application to enter an unstable state. Attacks of this type differ from Data Structure Attacks in that the latter attacks subvert the underlying structures that hold user-provided data, either pre-empting interpretation of the input (in the case of Buffer Overflows) or resulting in values that the targeted application is unable to handle correctly (in the case of Integer Overflows). In Injection attacks, the input is interpreted by the application, but the attacker has included instructions to the interpreting functions that the target application then follows.
Source: CAPEC™ 152
Related ASVS Requirements
ASVS (5.0): 1.1.1, 1.1.2, 1.2.1, 1.2.2, 1.2.3, 1.2.9, 1.3.1, 1.3.10, 1.3.11, 1.3.12, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.3.9, 1.5.3, 15.3.5, 15.3.6, 16.3.3, 16.4.1, 16.5.1, 16.5.3, 2.1.1, 2.1.2, 2.1.3, 2.2.1, 2.2.2, 2.2.3, 2.3.2, 2.3.3, 3.1.1, 3.2.1, 3.2.2, 3.2.3, 3.4.3, 3.4.4, 3.4.6, 3.4.7, 3.4.8, 3.5.4, 3.5.5, 3.5.6, 3.5.7, 3.5.8, 3.6.1, 3.7.5, 4.1.1, 5.4.1, 5.4.2
