235
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Relationship
"HTML injection" (see CWE-79: XSS) could be thought of as an example of this, but the code is
injected and executed on the client side, not the server side. Server-Side Includes (SSI) are an
example of direct static code injection.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Direct Static Code Injection
Software Fault Patterns SFP24 Tainted Input to Command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
35 Leverage Executable Code in Non-Executable Files
73 User-Controlled Filename
77 Manipulating User-Controlled Variables
81 Web Server Logs Tampering
85 AJAX Footprinting
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web
Page
Weakness ID : 97
Structure : Simple
Abstraction : Variant
Description
The product generates a web page, but does not neutralize or incorrectly neutralizes usercontrollable
input that could be interpreted as a server-side include (SSI) directive.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 96 Improper Neutralization of Directives in Statically Saved
Code ('Static Code Injection')