1747
Reference Description
https://www.cve.org/CVERecord?id=CVE-2005-1971
CVE-2005-3335 PHP file inclusion issue, both remote and local; local include uses ".." and
"%00" characters as a manipulation, but many remote file inclusion issues
probably have this vector.
https://www.cve.org/CVERecord?id=CVE-2005-3335
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 813 OWASP Top Ten 2010 Category A4 - Insecure Direct
Object References
809 2357
MemberOf 864 2011 Top 25 - Insecure Interaction Between
Components
900 2371
MemberOf 884 CWE Cross-section 884 2567
MemberOf 1354 OWASP Top Ten 2021 Category A08:2021 - Software
and Data Integrity Failures
1344 2495
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Related Attack Patterns
CAPEC-ID Attack Pattern Name
175 Code Inclusion
201 Serialized Data External Linking
228 DTD Injection
251 Local Code Inclusion
252 PHP Local File Inclusion
253 Remote Code Inclusion
263 Force Use of Corrupted Files
538 Open-Source Library Manipulation
549 Local Execution of Code
640 Inclusion of Code in Existing Process
660 Root/Jailbreak Detection Evasion via Hooking
695 Repo Jacking
698 Install Malicious Extension
References
[REF-45]OWASP. "OWASP Enterprise Security API (ESAPI) Project". < http://www.owasp.org/
index.php/ESAPI >.
[REF-76]Sean Barnum and Michael Gegick. "Least Privilege". 2005 September 4. < https://
web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/least-privilege >.2023-04-07.
CWE-830: Inclusion of Web Functionality from an Untrusted Source
Weakness ID : 830
Structure : Simple
Abstraction : Variant
Description
CWE Version 4.14
CWE-830: Inclusion of Web Functionality from an Untrusted Source
CWE-830: Inclusion of Web Functionality from an Untrusted Source