1808
Refactor the code so that internal program variables do not need to be dynamically identified.
Demonstrative Examples
Example 1:
This code uses the credentials sent in a POST request to login a user.
Example Language: PHP (Bad)
//Log user in, and set $isAdmin to true if user is an administrator
function login($user,$pass){
$query = buildQuery($user,$pass);
mysql_query($query);
if(getUserRole($user) == "Admin"){
$isAdmin = true;
}
}
$isAdmin = false;
extract($_POST);
login(mysql_real_escape_string($user),mysql_real_escape_string($pass));
The call to extract() will overwrite the existing values of any variables defined previously, in this
case $isAdmin. An attacker can send a POST request with an unexpected third value "isAdmin"
equal to "true", thus gaining Admin privileges.
Observed Examples
Reference Description
CVE-2006-7135 extract issue enables file inclusion
https://www.cve.org/CVERecord?id=CVE-2006-7135
CVE-2006-7079 Chain: extract used for register_globals compatibility layer, enables path
traversal (CWE-22)
https://www.cve.org/CVERecord?id=CVE-2006-7079
CVE-2007-0649 extract() buried in include files makes post-disclosure analysis confusing;
original report had seemed incorrect.
https://www.cve.org/CVERecord?id=CVE-2007-0649
CVE-2006-6661 extract() enables static code injection
https://www.cve.org/CVERecord?id=CVE-2006-6661
CVE-2006-2828 import_request_variables() buried in include files makes post-disclosure
analysis confusing
https://www.cve.org/CVERecord?id=CVE-2006-2828
CVE-2009-0422 Chain: Dynamic variable evaluation allows resultant remote file inclusion and
path traversal.
https://www.cve.org/CVERecord?id=CVE-2009-0422
CVE-2007-2431 Chain: dynamic variable evaluation in PHP program used to modify critical,
unexpected $_SERVER variable for resultant XSS.
https://www.cve.org/CVERecord?id=CVE-2007-2431
CVE-2006-4904 Chain: dynamic variable evaluation in PHP program used to conduct remote
file inclusion.
https://www.cve.org/CVERecord?id=CVE-2006-4904
CVE-2006-4019 Dynamic variable evaluation in mail program allows reading and modifying
attachments and preferences of other users.
https://www.cve.org/CVERecord?id=CVE-2006-4019
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-915: Improperly Controlled Modification
of Dynamically-Determined Object Attributes