CWE-598 (通过GET请求中的查询字符串导致的信息暴露) — Vulnerability Class 55

CWE-598 represents a critical information exposure weakness where web applications inadvertently transmit sensitive data via HTTP query strings. This vulnerability typically arises when developers use GET requests to handle authentication credentials, session tokens, or personally identifiable information, which are then visibly appended to the URL. Attackers exploit this by intercepting network traffic, accessing browser history, or analyzing server logs to harvest these exposed secrets. Since query strings are frequently cached by proxies, stored in browser history, and logged by web servers, the data remains persistently accessible to unauthorized parties. To mitigate this risk, developers should strictly utilize POST requests for transmitting sensitive payloads, ensuring data is enclosed within the HTTP body rather than the URL. Additionally, implementing HTTPS encryption and adhering to secure coding standards further protects data integrity and prevents accidental leakage through standard web infrastructure mechanisms.