1396
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Notes
Terminology
Current usage of "poison null byte" is typically related to this C/Perl/PHP interaction error, but the
original term in 1998 was applied to an off-by-one buffer overflow involving a null byte.
Research Gap
There are not many CVE examples, because the poison NULL byte is a design limitation, which
typically is not included in CVE by itself. It is typically used as a facilitator manipulation to widen
the scope of potential attacks against other vulnerabilities.
References
[REF-514]Rain Forest Puppy. "Poison NULL byte". Phrack 55. < https://insecure.org/news/
P55-07.txt >.2023-04-07.
[REF-515]Brett Moore. "0x00 vs ASP file upload scripts". < http://www.security-assessment.com/
Whitepapers/0x00_vs_ASP_File_Uploads.pdf >.
[REF-516]ShAnKaR. "ShAnKaR: multiple PHP application poison NULL byte vulnerability". <
https://seclists.org/fulldisclosure/2006/Sep/185 >.2023-04-07.
CWE-627: Dynamic Variable Evaluation
Weakness ID : 627
Structure : Simple
Abstraction : Variant
Description
In a language where the user can influence the name of a variable at runtime, if the variable names
are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
Extended Description
The resultant vulnerabilities depend on the behavior of the application, both at the crossover point
and in any control/data flow that is reachable by the related variables or functions.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 914 Improper Control of Dynamically-Identified Variables 1807
PeerOf 183 Permissive List of Allowed Inputs 458
Weakness Ordinalities
Primary :
Applicable Platforms
Language : PHP (Prevalence = Undetermined)
Language : Perl (Prevalence = Undetermined)
CWE Version 4.14
CWE-627: Dynamic Variable Evaluation
CWE-627: Dynamic Variable Evaluation