CWE-473 PHP参数外部修改

PHP External Variable Modification

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 471 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 471 cwe_View_ID: 699 cwe_Ordinal: Primary

  • cwe_Nature: CanPrecede cwe_CWE_ID: 98 cwe_View_ID: 1000

适用平台

Language: {'cwe_Name': 'PHP', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围 影响 注释
Integrity Modify Application Data

可能的缓解方案

['Requirements', 'Implementation']

策略:

Carefully identify which variables can be controlled or influenced by an external user, and consider adopting a naming convention to emphasize when externally modifiable variables are being used. An application should be reluctant to trust variables that have been initialized outside of its trust boundary. Ensure adequate checking is performed when relying on input from outside a trust boundary. Do not allow your application to run with register_globals enabled. If you implement a register_globals emulator, be extremely careful of variable extraction, dynamic evaluation, and similar issues, since weaknesses in your emulation could allow external variable modification to take place even without register_globals.

分析过的案例

标识 说明 链接
CVE-2000-0860 File upload allows arbitrary file read by setting hidden form variables to match internal variable names. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0860
CVE-2001-0854 Mistakenly trusts $PHP_SELF variable to determine if include script was called by its parent. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0854
CVE-2002-0764 PHP remote file inclusion by modified assumed-immutable variable. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0764
CVE-2001-1025 Modify key variable when calling scripts that don't load a library that initializes it. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1025
CVE-2003-0754 Authentication bypass by modifying array used for authentication. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0754

Notes

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
PLOVER PHP External Variable Modification

相关攻击模式

  • CAPEC-77