223
include($MessageFile);
}
While the programmer intends for the MessageFile to only include data, an attacker can provide a
message such as:
Example Language: (Attack)
name=h4x0r
message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E
which will decode to the following:
Example Language: (Attack)
<?php system("/bin/ls -l");?>
The programmer thought they were just including the contents of a regular data file, but PHP
parsed it and executed the code. Now, this code is executed any time people view messages.
Notice that XSS (CWE-79) is also possible in this situation.
Example 2:
edit-config.pl: This CGI script is used to modify settings in a configuration file.
Example Language: Perl (Bad)
use CGI qw(:standard);
sub config_file_add_key {
my ($fname, $key, $arg) = @_;
# code to add a field/key to a file goes here
}
sub config_file_set_key {
my ($fname, $key, $arg) = @_;
# code to set key to a particular file goes here
}
sub config_file_delete_key {
my ($fname, $key, $arg) = @_;
# code to delete key from a particular file goes here
}
sub handleConfigAction {
my ($fname, $action) = @_;
my $key = param('key');
my $val = param('val');
# this is super-efficient code, especially if you have to invoke
# any one of dozens of different functions!
my $code = "config_file_$action_key(\$fname, \$key, \$val);";
eval($code);
}
$configfile = "/home/cwe/config.txt";
print header;
if (defined(param('action'))) {
handleConfigAction($configfile, param('action'));
}
else {
print "No action specified!\n";
}
The script intends to take the 'action' parameter and invoke one of a variety of functions
based on the value of that parameter - config_file_add_key(), config_file_set_key(), or
config_file_delete_key(). It could set up a conditional to invoke each function separately, but eval()
is a powerful way of doing the same thing in fewer lines of code, especially when a large number
CWE Version 4.14
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')