Collected research

On Race Vulnerabilities in Web Applications

Roberto Paleari, Davide Marrone, Danilo Bruschi and Mattia Monga · roberto.greyhats.it

DIMVA 2008 paper on race conditions in web applications, arising because programmers treat scripts as sequential while the server runs many instances against one shared database. It gives a dynamic detection method that replays interleaved request pairs and compares database state, with SQL annotations to suppress benign reports. Real races were found in Joomla, phpBB, WordPress and Zen Cart.

Record

Researcher

Roberto Paleari, Davide Marrone, Danilo Bruschi and Mattia Monga

Published by

roberto.greyhats.it

Format

Whitepaper

Topic

Other

In the archive

• Collected in the 2008 research round

Related sources

• Concurrency Attacks in Web Applications Whitepaper

Tags

• race-condition
• toctou
• database
• mysql
• php
• dynamic-analysis
• detection
• tooling
• owasp-a04-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Roberto Paleari, Davide Marrone, Danilo Bruschi and Mattia Monga, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.