CWE-473 PHP参数外部修改

PHP External Variable Modification

结构: Simple

Abstraction: Variant

状态: Draft

被利用可能性: unkown

基本描述

A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 471 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 471 cwe_View_ID: 699 cwe_Ordinal: Primary

• cwe_Nature: CanPrecede cwe_CWE_ID: 98 cwe_View_ID: 1000

适用平台

Language: {'cwe_Name': 'PHP', 'cwe_Prevalence': 'Undetermined'}

常见的影响

可能的缓解方案

['Requirements', 'Implementation']

策略:

Carefully identify which variables can be controlled or influenced by an external user, and consider adopting a naming convention to emphasize when externally modifiable variables are being used. An application should be reluctant to trust variables that have been initialized outside of its trust boundary. Ensure adequate checking is performed when relying on input from outside a trust boundary. Do not allow your application to run with register_globals enabled. If you implement a register_globals emulator, be extremely careful of variable extraction, dynamic evaluation, and similar issues, since weaknesses in your emulation could allow external variable modification to take place even without register_globals.

分析过的案例

Notes

分类映射

相关攻击模式

• CAPEC-77

文章来源于互联网:scap中文网