1127
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Web Parameter Tampering
OWASP Top Ten 2007 A4 CWE More Specific Insecure Direct Object Reference
OWASP Top Ten 2004 A1 CWE More Specific Unvalidated Input
Related Attack Patterns
CAPEC-ID Attack Pattern Name
31 Accessing/Intercepting/Modifying HTTP Cookies
39 Manipulating Opaque Client-based Data Tokens
146 XML Schema Poisoning
226 Session Credential Falsification through Manipulation
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-473: PHP External Variable Modification
Weakness ID : 473
Structure : Simple
Abstraction : Variant
Description
A PHP application does not properly protect against the modification of variables from external
sources, such as query parameters or cookies. This can expose the application to numerous
weaknesses that would not exist otherwise.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 471 Modification of Assumed-Immutable Data (MAID) 1121
PeerOf 616 Incomplete Identification of Uploaded File Variables (PHP) 1376
CanPrecede 98 Improper Control of Filename for Include/Require Statement
in PHP Program ('PHP Remote File Inclusion')