1397
Background Details
Many interpreted languages support the use of a "$$varname" construct to set a variable whose
name is specified by the $varname variable. In PHP, these are referred to as "variable variables."
Functions might also be invoked using similar syntax, such as $$funcname(arg1, arg2).
Alternate Terms
Dynamic evaluation :
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Modify Application Data
Execute Unauthorized Code or Commands
An attacker could gain unauthorized access to internal
program variables and execute arbitrary code.
Potential Mitigations
Phase: Implementation
Strategy = Refactoring
Refactor the code to avoid dynamic variable evaluation whenever possible.
Phase: Implementation
Strategy = Input Validation
Use only allowlists of acceptable variable or function names.
Phase: Implementation
For function names, ensure that you are only calling functions that accept the proper number of
arguments, to avoid unexpected null arguments.
Observed Examples
Reference Description
CVE-2009-0422 Chain: Dynamic variable evaluation allows resultant remote file inclusion and
path traversal.
https://www.cve.org/CVERecord?id=CVE-2009-0422
CVE-2007-2431 Chain: dynamic variable evaluation in PHP program used to modify critical,
unexpected $_SERVER variable for resultant XSS.
https://www.cve.org/CVERecord?id=CVE-2007-2431
CVE-2006-4904 Chain: dynamic variable evaluation in PHP program used to conduct remote
file inclusion.
https://www.cve.org/CVERecord?id=CVE-2006-4904
CVE-2006-4019 Dynamic variable evaluation in mail program allows reading and modifying
attachments and preferences of other users.
https://www.cve.org/CVERecord?id=CVE-2006-4019
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
CWE Version 4.14
CWE-628: Function Call with Incorrectly Specified Arguments
CWE-628: Function Call with Incorrectly Specified Arguments