231
Reference Description
CVE-2008-5305 Eval injection in Perl program using an ID that should only contain hyphens
and numbers.
https://www.cve.org/CVERecord?id=CVE-2008-5305
CVE-2002-1752 Direct code injection into Perl eval function.
https://www.cve.org/CVERecord?id=CVE-2002-1752
CVE-2002-1753 Eval injection in Perl program.
https://www.cve.org/CVERecord?id=CVE-2002-1753
CVE-2005-1527 Direct code injection into Perl eval function.
https://www.cve.org/CVERecord?id=CVE-2005-1527
CVE-2005-2837 Direct code injection into Perl eval function.
https://www.cve.org/CVERecord?id=CVE-2005-2837
CVE-2005-1921 MFV. code injection into PHP eval statement using nested constructs that
should not be nested.
https://www.cve.org/CVERecord?id=CVE-2005-1921
CVE-2005-2498 MFV. code injection into PHP eval statement using nested constructs that
should not be nested.
https://www.cve.org/CVERecord?id=CVE-2005-2498
CVE-2005-3302 Code injection into Python eval statement from a field in a formatted file.
https://www.cve.org/CVERecord?id=CVE-2005-3302
CVE-2007-1253 Eval injection in Python program.
https://www.cve.org/CVERecord?id=CVE-2007-1253
CVE-2001-1471 chain: Resultant eval injection. An invalid value prevents initialization of
variables, which can be modified by attacker and later injected into PHP eval
statement.
https://www.cve.org/CVERecord?id=CVE-2001-1471
CVE-2007-2713 Chain: Execution after redirect triggers eval injection.
https://www.cve.org/CVERecord?id=CVE-2007-2713
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 714 OWASP Top Ten 2007 Category A3 - Malicious File
Execution
629 2331
MemberOf 727 OWASP Top Ten 2004 Category A6 - Injection Flaws 711 2337
MemberOf 884 CWE Cross-section 884 2567
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1179 SEI CERT Perl Coding Standard - Guidelines 01. Input
Validation and Data Sanitization (IDS)
1178 2465
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Other
Factors: special character errors can play a role in increasing the variety of code that can be
injected, although some vulnerabilities do not require special characters at all, e.g. when a single
function without arguments can be referenced and a terminator character is not necessary.
Taxonomy Mappings
CWE Version 4.14
CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
CWE-96: Improper Neutralization of Directives
in Statically Saved Code ('Static Code Injection') 232
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Direct Dynamic Code Evaluation ('Eval
Injection')
OWASP Top Ten 2007 A3 CWE More Specific Malicious File Execution
OWASP Top Ten 2004 A6 CWE More Specific Injection Flaws
Software Fault Patterns SFP24 Tainted input to command
SEI CERT Perl Coding
Standard
IDS35-
PL
Exact Do not invoke the eval form with a
string argument
Related Attack Patterns
CAPEC-ID Attack Pattern Name
35 Leverage Executable Code in Non-Executable Files
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-1372]"How ast.literal_eval can cause memory exhaustion". 2022
December 4. Reddit. < https://www.reddit.com/r/learnpython/comments/zmbhcf/
how_astliteral_eval_can_cause_memory_exhaustion/ >.2023-11-03.
[REF-1373]"ast - Abstract Syntax Trees". 2023 November 2. Python. < https://docs.python.org/3/
library/ast.html#ast.literal_eval >.2023-11-03.
CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static
Code Injection')
Weakness ID : 96
Structure : Simple
Abstraction : Base
Description
The product receives input from an upstream component, but it does not neutralize or incorrectly
neutralizes code syntax before inserting the input into an executable resource, such as a library,
configuration file, or template.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 94 Improper Control of Generation of Code ('Code Injection') 219
ParentOf 97 Improper Neutralization of Server-Side Includes (SSI) Within
a Web Page