CAPEC-137
Parameter Injection
An adversary manipulates the content of request parameters for the purpose of undermining the security of the target. Some parameter encodings use text characters as separators. For example, parameters in a HTTP GET message are encoded as name-value pairs separated by an ampersand (&). If an attacker can supply text strings that are used to fill in these parameters, then they can inject special characters used in the encoding scheme to add or modify parameters. For example, if user input is fed directly into an HTTP GET request and the user provides the value "myInput&new_param=myValue", then the input parameter is set to myInput, but a new parameter (new_param) is also added with a value of myValue. This can significantly change the meaning of the query that is processed by the server. Any encoding scheme where parameters are identified and separated by text characters is potentially vulnerable to this attack - the HTTP GET encoding used above is just one example.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-137: Parameter Injection: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/137.html and https://cve.bz/cve/capec/137?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The target application must use a parameter encoding where separators and parameter identifiers are expressed in regular text.
The target application must accept a string as user input, fail to sanitize characters that have a special meaning in the parameter encoding, and insert the user-supplied string in an encoding which is then processed.
Resources required
None: No specialized resources are required to execute this type of attack. The only requirement is the ability to provide string input to the target.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Modify Data | Integrity | Successful parameter injection attacks mean a compromise to integrity of the application. |
Mitigations
Implement an audit log written to a separate host. In the event of a compromise, the audit log may be able to provide evidence and details of the compromise.
Treat all user input as untrusted data that must be validated before use.
Weaknesses it exploits
- CWE-88 Improper Neutralization of Argument Delimiters in a Command
Recent CVEs with these weaknesses
- 4.9CVE-2026-107404
Argument injection in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.
- 6.7CVE-2026-105669
Argument injection in Ivanti Sentry before version 10.8.3 and 10.7.4 allows a remote authenticated attacker with admin privileges to execute arbitrary on-disk binaries.
- 6.6CVE-2026-125672
A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option ins…
- 7.5CVE-2026-63644
bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. Th…
- 6.7CVE-2026-84503
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is i…
- 6.7CVE-2026-82830
IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters.
- 9.9CVE-2026-17410
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access and modify other tenants' portal data due to improper neutralization of argument delimiters.
- 2.7CVE-2026-17062
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify internal requests due to improper neutralization of argument delimiters. Special characters in user-supplied inp…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
MITRE's words, unchanged: CAPEC-137 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.