Lab: Web cache poisoning via an unkeyed query string
Summary: PortSwigger's lab demonstrates web cache poisoning where the query string is unkeyed, so arbitrary query parameters can be changed without causing a cache miss. The solution injects a payload through a reflected parameter, replays until the response is cached with an X-Cache: hit header, then removes the query string so normal visitors receive the poisoned cached page.
What you should know: A cache that ignores the query string lets one crafted request plant a script that runs in every visitor's browser until the cache is refreshed, and the lab notes re-poisoning may be needed after 35 seconds.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026