1387
}
}
$isAdmin = false;
extract($_POST);
login(mysql_real_escape_string($user),mysql_real_escape_string($pass));
The call to extract() will overwrite the existing values of any variables defined previously, in this
case $isAdmin. An attacker can send a POST request with an unexpected third value "isAdmin"
equal to "true", thus gaining Admin privileges.
Observed Examples
Reference Description
CVE-2006-7135 extract issue enables file inclusion
https://www.cve.org/CVERecord?id=CVE-2006-7135
CVE-2006-7079 Chain: PHP app uses extract for register_globals compatibility layer
(CWE-621), enabling path traversal (CWE-22)
https://www.cve.org/CVERecord?id=CVE-2006-7079
CVE-2007-0649 extract() buried in include files makes post-disclosure analysis confusing;
original report had seemed incorrect.
https://www.cve.org/CVERecord?id=CVE-2007-0649
CVE-2006-6661 extract() enables static code injection
https://www.cve.org/CVERecord?id=CVE-2006-6661
CVE-2006-2828 import_request_variables() buried in include files makes post-disclosure
analysis confusing
https://www.cve.org/CVERecord?id=CVE-2006-2828
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Research Gap
Probably under-reported for PHP. Seems under-studied for other interpreted languages.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP24 Tainted input to command
CWE-622: Improper Validation of Function Hook Arguments
Weakness ID : 622
Structure : Simple
Abstraction : Variant
Description
The product adds hooks to user-accessible API functions, but it does not properly validate the
arguments. This could lead to resultant vulnerabilities.
Extended Description
CWE Version 4.14
CWE-622: Improper Validation of Function Hook Arguments
CWE-622: Improper Validation of Function Hook Arguments