strange combination of "Set-Cookie" and interleaved pattern of True/False like responses can result in bypassing of the ABAB test

stamparm · stamparm · commit 3abcd6910ab5 · 2012-03-22T00:06:50.000Z
diff --git a/lib/controller/checks.py b/lib/controller/checks.py
@@ -556,10 +556,10 @@ def _():
             retVal = None
         elif checkBooleanExpression("%d>(%d+%d)" % (min(randInt1, randInt2), randInt3, max(randInt1, randInt2))):
             retVal = None
-        elif not checkBooleanExpression("%d=(%d+%d)" % (randInt1 + randInt2, randInt1, randInt2)):
-            retVal = None
         elif checkBooleanExpression("(%d+%d)>%d" % (randInt3, min(randInt1, randInt2), randInt1 + randInt2 + randInt3)):
             retVal = None
+        elif not checkBooleanExpression("%d=(%d+%d)" % (randInt1 + randInt2, randInt1, randInt2)):
+            retVal = None
 
         if retVal is None:
             warnMsg = "false positive or unexploitable injection point detected"
