Dead Code: Unused Parameter

Use of parameters that trigger unexposed, privileged functionality can allow an attacker to gain unauthorized access to application resources.

Unused parameters represent data that is processed by the application code but is not made available to the users through any of the request parameters. These parameters can be used to aid debugging, enable privileged functionality known only to the programmers or administrators of the web site, or act as a backdoor. If discovered by an attacker, use of these parameters can lead to unauthorized access to privileged functionality or be used to inject arbitrary code into the application. Programmers sometimes leave behind functionality in product code that was only meant for debugging and incorrectly assume they can hide privileged functionality by not exposing it through publicly accessible interfaces.

The presence of unused parameters can expose an application to certain risks:
- It can indicate dead code in an application, which is not exposed to legitimate application users. However, a malicious user might get access to functionality in dead code by supplying brute force parameter name/value pairs (e.g. debug=true). If the code accesses sensitive resources such as databases and file IO, it can threaten the overall security of the application.
- It can indicate a backdoor into the application planted by a developer with malicious intent, which can be used later to gain unlawful access to application data or perform serious attacks against the application.