Typical severity: Medium. An adversary adds duplicate HTTP GET/POST parameters by injecting query string delimiters. Via HPP it may be possible to override existing hardcoded HTTP parameters, modify the application behaviors, access and, potentially exploit, uncontrollable variables, and bypass input validation checkpoints and WAF rules.
Configuration: If using a Web Application Firewall (WAF), filters should be carefully configured to detect abnormal HTTP requests | Design: Perform URL encoding | Implementation: Use strict regular expressions in URL rewriting | Implementation: Beware of multiple occurrences of a parameter in a Query String