220
Extended Description
When a product allows a user's input to contain code syntax, it might be possible for an attacker
to craft the code in such a way that it will alter the intended control flow of the product. Such an
alteration could lead to arbitrary code execution.
Injection problems encompass a wide variety of issues -- all mitigated in very different ways. For
this reason, the most effective way to discuss these weaknesses is to note the distinct features
which classify them as injection weaknesses. The most important issue to note is that all injection
problems share one thing in common -- i.e., they allow for the injection of control plane data into
the user-controlled data plane. This means that the execution of the process may be altered
by sending code in through legitimate data channels, using no other mechanism. While buffer
overflows, and many other flaws, involve the use of some further issue to gain execution, injection
problems need only for the data to be parsed. The most classic instantiations of this category of
weakness are SQL injection and format string vulnerabilities.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 913 Improper Control of Dynamically-Managed Code Resources 1805
ChildOf 74 Improper Neutralization of Special Elements in Output Used
by a Downstream Component ('Injection')