1128
Phase: Requirements
Phase: Implementation
Carefully identify which variables can be controlled or influenced by an external user, and
consider adopting a naming convention to emphasize when externally modifiable variables
are being used. An application should be reluctant to trust variables that have been initialized
outside of its trust boundary. Ensure adequate checking is performed when relying on input from
outside a trust boundary. Do not allow your application to run with register_globals enabled. If
you implement a register_globals emulator, be extremely careful of variable extraction, dynamic
evaluation, and similar issues, since weaknesses in your emulation could allow external variable
modification to take place even without register_globals.
Observed Examples
Reference Description
CVE-2000-0860 File upload allows arbitrary file read by setting hidden form variables to match
internal variable names.
https://www.cve.org/CVERecord?id=CVE-2000-0860
CVE-2001-0854 Mistakenly trusts $PHP_SELF variable to determine if include script was called
by its parent.
https://www.cve.org/CVERecord?id=CVE-2001-0854
CVE-2002-0764 PHP remote file inclusion by modified assumed-immutable variable.
https://www.cve.org/CVERecord?id=CVE-2002-0764
CVE-2001-1025 Modify key variable when calling scripts that don't load a library that initializes
it.
https://www.cve.org/CVERecord?id=CVE-2001-1025
CVE-2003-0754 Authentication bypass by modifying array used for authentication.
https://www.cve.org/CVERecord?id=CVE-2003-0754
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 991 SFP Secondary Cluster: Tainted Input to Environment 888 2416
MemberOf 1415 Comprehensive Categorization: Resource Control 1400 2544
Notes
Relationship
This is a language-specific instance of Modification of Assumed-Immutable Data (MAID). This
can be resultant from direct request (alternate path) issues. It can be primary to weaknesses
such as PHP file inclusion, SQL injection, XSS, authentication bypass, and others.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER PHP External Variable Modification
Related Attack Patterns
CAPEC-ID Attack Pattern Name
77 Manipulating User-Controlled Variables
CWE-474: Use of Function with Inconsistent Implementations
Weakness ID : 474
Structure : Simple
CWE Version 4.14
CWE-474: Use of Function with Inconsistent Implementations
CWE-474: Use of Function with Inconsistent Implementations