EIP-2026-118671

This advisory details an HTTP Parameter Pollution (HPP) technique to bypass IBM Web Application Firewall by splitting malicious SQL injection payloads across multiple parameters. The technique leverages IIS/ASP.NET parameter concatenation behavior to evade detection while maintaining functional SQL syntax.