286
Example Language: (Attack)
' pwd
then the program will encode the apostrophe and insert the semicolon, which functions as a
command separator when passed to the system function. This allows the attacker to complete the
command injection.
Observed Examples
Reference Description
CVE-2021-41232 Chain: authentication routine in Go-based agile development product does not
escape user name (CWE-116), allowing LDAP injection (CWE-90)
https://www.cve.org/CVERecord?id=CVE-2021-41232
CVE-2008-4636 OS command injection in backup software using shell metacharacters in
a filename; correct behavior would require that this filename could not be
changed.
https://www.cve.org/CVERecord?id=CVE-2008-4636
CVE-2008-0769 Web application does not set the charset when sending a page to a browser,
allowing for XSS exploitation when a browser chooses an unexpected
encoding.
https://www.cve.org/CVERecord?id=CVE-2008-0769
CVE-2008-0005 Program does not set the charset when sending a page to a browser, allowing
for XSS exploitation when a browser chooses an unexpected encoding.
https://www.cve.org/CVERecord?id=CVE-2008-0005
CVE-2008-5573 SQL injection via password parameter; a strong password might contain "&"
https://www.cve.org/CVERecord?id=CVE-2008-5573
CVE-2008-3773 Cross-site scripting in chat application via a message subject, which normally
might contain "&" and other XSS-related characters.
https://www.cve.org/CVERecord?id=CVE-2008-3773
CVE-2008-0757 Cross-site scripting in chat application via a message, which normally might be
allowed to contain arbitrary content.
https://www.cve.org/CVERecord?id=CVE-2008-0757
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 751 2009 Top 25 - Insecure Interaction Between
Components
750 2352
MemberOf 845 The CERT Oracle Secure Coding Standard for
Java (2011) Chapter 2 - Input Validation and Data
Sanitization (IDS)
844 2362
MemberOf 883 CERT C++ Secure Coding Section 49 - Miscellaneous
(MSC)
868 2381
MemberOf 992 SFP Secondary Cluster: Faulty Input Transformation 888 2416
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1134 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 00. Input Validation and Data Sanitization
(IDS)
1133 2444
MemberOf 1179 SEI CERT Perl Coding Standard - Guidelines 01. Input
Validation and Data Sanitization (IDS)
1178 2465
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
CWE Version 4.14
CWE-116: Improper Encoding or Escaping of Output
CWE-116: Improper Encoding or Escaping of Output