Common Web Vulnerabilities

Common Web Vulnerabilities

Modern websites and web applications process user input, authenticate users,
store information and communicate with other systems. Every one of these
functions can introduce security risks if they are implemented incorrectly.

A web vulnerability is a weakness that can allow an attacker to violate the
confidentiality, integrity or availability of an application or its data.

1. Why Developers Need to Understand Vulnerabilities

Cybersecurity is not only the responsibility of a security team. Developers
design the application logic that determines how input is processed, how
permissions work and how sensitive information is protected.

2. Injection

Injection vulnerabilities occur when untrusted data is interpreted as part of
a command or query.

Examples include SQL injection, operating-system command injection and other
forms of interpreter injection.

3. SQL Injection

SQL injection occurs when attacker-controlled input is incorporated into a
database query in an unsafe way.

The primary defence is parameterized database queries or prepared statements.

<?php

$stmt = $pdo->prepare(
	'SELECT id, username FROM users WHERE username = :username'
);

$stmt->execute(
	array(
		':username' => $username,
	)
);

4. Cross-Site Scripting

Cross-site scripting, commonly called XSS, occurs when attacker-controlled
content is executed as code in another user’s browser.

XSS can affect confidentiality, integrity and user trust.

Defences include context-aware output encoding, safe templating, input
validation where appropriate and a strong Content Security Policy.

5. Stored XSS

Stored XSS occurs when malicious content is saved by an application and later
displayed to other users.

Comments, profiles and other user-generated content can become dangerous when
output is not handled safely.

6. Reflected XSS

Reflected XSS occurs when malicious input is immediately reflected in a
response and executed by a victim’s browser.

7. Cross-Site Request Forgery

CSRF causes a user’s browser to submit an unwanted authenticated request.

Applications should use anti-CSRF tokens and appropriate SameSite cookie
controls for state-changing operations.

8. Broken Access Control

Broken access control occurs when an application fails to correctly enforce
who can access a resource or perform an action.

A common development mistake is hiding a button without enforcing the
permission on the server.

9. Authentication Failures

Authentication weaknesses can allow attackers to gain unauthorized access.

Examples include weak password handling, missing MFA, predictable reset tokens,
poor session management and insufficient protection against automated attacks.

10. Security Misconfiguration

Security misconfiguration occurs when systems are deployed with unsafe
settings.

• Debug mode enabled in production.
• Default credentials.
• Unnecessary services.
• Excessive permissions.
• Missing security headers.
• Detailed error messages exposed to users.

11. Insecure File Uploads

File upload functionality can create serious risks when applications fail to
validate file types, names, sizes and storage locations.

Uploaded files should be handled using secure validation and storage practices.

12. Path Traversal

Path traversal occurs when an attacker manipulates file paths to access files
outside the intended directory.

Applications should never trust file paths supplied directly by users.

13. Insecure Direct Object References

An application may expose an identifier for a resource without checking
whether the current user is authorized to access that resource.

Changing an ID in a URL must not automatically grant access to another user’s
record.

14. Server-Side Request Forgery

Server-side request forgery, or SSRF, occurs when an application can be
tricked into making network requests chosen by an attacker.

Applications that fetch remote URLs should carefully validate destinations and
restrict access to sensitive internal resources.

15. Sensitive Data Exposure

Applications may accidentally expose sensitive information through responses,
logs, backups, source code, error messages or insecure storage.

Developers should identify sensitive data and protect it throughout its
lifecycle.

16. Security Headers

Security-related HTTP headers can provide additional browser-side protections.
Examples include Content-Security-Policy, X-Content-Type-Options and
Referrer-Policy.

17. Vulnerable Dependencies

Modern applications depend on libraries, plugins and frameworks. A vulnerable
dependency may introduce risk even when application code appears correct.

Dependencies should be inventoried, updated and monitored.

18. Error Handling

Production applications should not expose stack traces, database details,
internal paths or secrets in error responses.

Detailed diagnostic information should be available securely to authorized
developers through protected logging systems.

19. Secure Development Principles

• Validate untrusted input.
• Encode output in the correct context.
• Use parameterized database queries.
• Enforce authorization on the server.
• Use secure authentication mechanisms.
• Protect sessions.
• Protect sensitive data.
• Keep dependencies updated.
• Use secure defaults.
• Log security events without logging secrets.

20. Defence in Depth

No single security control is perfect. Defence in depth uses multiple layers
so that failure of one control does not automatically result in compromise.

21. Practical Authorized Lab

Create a local PHP application containing a login page, database lookup and
user profile. Review the application and identify where input validation,
output encoding, authorization and session security should be applied.

Do not perform vulnerability testing against systems you do not own or have
explicit permission to test.

22. Knowledge Check

1. What is a web vulnerability?
2. What is SQL injection?
3. How can prepared statements reduce SQL injection risk?
4. What is XSS?
5. What is CSRF?
6. What is broken access control?
7. What is security misconfiguration?
8. Why are file uploads security-sensitive?
9. What is SSRF?
10. Why is defence in depth important?

23. Summary

Common web vulnerabilities are usually caused by failures to validate input,
encode output, enforce authorization, protect authentication or securely
configure applications.

Understanding these vulnerabilities helps developers build applications that
are secure by design rather than trying to fix security problems after
deployment.