Say a PHP page accepts URL path as a POST parameter (like the answer to this question):
$path = $_POST['url_path'];
file_get_contents('http://example.com' . $path);
A maliicious user POSTs url_path as @evil.com/stuff.html.
As the code takes the user input and appends it without a delimiter to end the username section (e.g. ?, /), $path ends up as:
http://example.com@evil.com/stuff.html
which means username example.com accessing http://evil.com/stuff.html.
Is there already a specific name for this type of attack? The closest I found was Semantic URL attack, however this seems more syntaxic. It appears to be a type of URL obfuscation, however as it is on the server and not visible to the end-user in the address bar it is a slightly different type of attack to Phishing.
Note: The code is also vulnerable to other types of domain manipulation such as appending something to change the interpretation to another top level domain (e.g. POSTing .uk to change example.co). So on that basis I would just call it a general string concatenation flaw rather than an attack specifically relating to URLs - however, I'd like to put this out to the floor.
