1386
import_request_variables() without the proper arguments could allow arbitrary global variables to
be overwritten, including superglobals.
Similar functionality is possible in other interpreted languages, including custom languages.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 914 Improper Control of Dynamically-Identified Variables 1807
CanPrecede 471 Modification of Assumed-Immutable Data (MAID) 1121
Weakness Ordinalities
Primary :
Applicable Platforms
Language : PHP (Prevalence = Undetermined)
Alternate Terms
Variable overwrite :
Common Consequences
Scope Impact Likelihood
Integrity Modify Application Data
An attacker could modify sensitive data or program
variables.
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Use allowlists of variable names that can be extracted.
Phase: Implementation
Consider refactoring your code to avoid extraction routines altogether.
Phase: Implementation
In PHP, call extract() with options such as EXTR_SKIP and EXTR_PREFIX_ALL; call
import_request_variables() with a prefix argument. Note that these capabilities are not present in
all PHP versions.
Demonstrative Examples
Example 1:
This code uses the credentials sent in a POST request to login a user.
Example Language: PHP (Bad)
//Log user in, and set $isAdmin to true if user is an administrator
function login($user,$pass){
$query = buildQuery($user,$pass);
mysql_query($query);
if(getUserRole($user) == "Admin"){
$isAdmin = true;
CWE Version 4.14
CWE-622: Improper Validation of Function Hook Arguments
CWE-622: Improper Validation of Function Hook Arguments