1398
Research Gap
Under-studied, probably under-reported. Few researchers look for this issue; most public reports
are for PHP, although other languages are affected. This issue is likely to grow in PHP as
developers begin to implement functionality in place of register_globals.
References
[REF-517]Steve Christey. "Dynamic Evaluation Vulnerabilities in PHP applications". Full-
Disclosure. 2006 May 3. < https://seclists.org/fulldisclosure/2006/May/35 >.2023-04-07.
[REF-518]Shaun Clowes. "A Study In Scarlet: Exploiting Common Vulnerabilities in PHP
Applications". < https://securereality.com.au/study-in-scarlett/ >.2023-04-07.
CWE-628: Function Call with Incorrectly Specified Arguments
Weakness ID : 628
Structure : Simple
Abstraction : Base
Description
The product calls a function, procedure, or routine with arguments that are not correctly specified,
leading to always-incorrect behavior and resultant weaknesses.
Extended Description
There are multiple ways in which this weakness can be introduced, including:
• the wrong variable or reference;
• an incorrect number of arguments;
• incorrect order of arguments;
• wrong type of arguments; or
• wrong value.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 573 Improper Following of Specification by Caller 1298
ParentOf 683 Function Call With Incorrect Order of Arguments 1504
ParentOf 685 Function Call With Incorrect Number of Arguments 1507
ParentOf 686 Function Call With Incorrect Argument Type 1508
ParentOf 687 Function Call With Incorrectly Specified Argument Value 1510
ParentOf 688 Function Call With Incorrect Variable or Reference as
Argument