Example insertion point check - Port Swigger
Summary: PortSwigger published a BCheck example that runs once for each insertion point found during a crawl, appending a simple mathematical calculation to a request payload. If the response returns the answer to that calculation, Burp Scanner reports an issue with tentative confidence, after first confirming the answer does not already appear in the base response to reduce false positives.
Key Takeaway: The check flags possible server-side code injection on nothing more than a returned arithmetic result, so a tentative-confidence finding here is a prompt to verify, not a confirmed vulnerability.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026