Out-of-band input channels
Summary: PortSwigger researcher Dafydd Stuttard describes out-of-band input channels as a significant and often buggy area of attack surface, where input reaches an application through means other than HTTP requests from a browser or client. He cites a reputed case of a speeding-camera application that used OCR to read registration plates into a SQL query, exploitable only by printing an attack string onto a plate and driving past a camera, with the bug fully blind and data retrieval limited by the 12 points on a license.
Why it matters: The example shows input paths your code review never sees: a plate read by OCR becomes a SQL query, and the only way to exploit it is to physically drive past a camera, so standard HTTP-focused testing would never surface it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026