CWEweakness

CWE-621 Variable Extraction Error

Official page ↗
Alternate terms
Variable overwrite
Abstraction
Variant
Structure
Simple
Status
Incomplete
Languages
Interpreted, PHP
CWE version
5.0

Description

The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid.

Common consequences

• Integrity: Modify Application Data — An attacker could cause the program to overwrite unintended variables. • Integrity: Modify Application Data — When using PHP, calling extract() or import_request_variables() without the proper arguments could allow arbitrary global variables to be overwritten, including superglobals.

Potential mitigations

• [Implementation] Use allowlists of variable names that can be extracted. • [Implementation] Consider refactoring your code to avoid extraction routines altogether. • [Implementation] In PHP, call extract() with options such as EXTR_SKIP and EXTR_PREFIX_ALL; call import_request_variables() with a prefix argument. Note that these capabilities are not present in all PHP versions.

Observed examples

• CVE-2006-7135: extract issue enables file inclusion • CVE-2006-7079: Chain: PHP app uses extract for register_globals compatibility layer (CWE-621), enabling path traversal (CWE-22) • CVE-2007-0649: extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect. • CVE-2006-6661: extract() enables static code injection • CVE-2006-2828: import_request_variables() buried in include files makes post-disclosure analysis confusing

Related

Observed example · CVE (5)

  • CVE-2006-7135 PHP remote file inclusion vulnerability in lib/functions.inc.php in PHP Poll Creator (phpPC) 1.04 allows remote attackers to execute… vulnerability
  • CVE-2006-7079 Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program… vulnerability
  • CVE-2007-0649 Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary… vulnerability
  • CVE-2006-6661 Variable overwrite vulnerability in blog.php in PHP-Update 2.7 and earlier allows remote attackers to overwrite arbitrary program variables… vulnerability
  • CVE-2006-2828 Global variable overwrite vulnerability in PHP-Nuke allows remote attackers to conduct remote PHP file inclusion attacks via a modified… vulnerability

Can precede · CWE (1)

  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

Child of · CWE (1)

  • CWE-914 Improper Control of Dynamically-Identified Variables weakness

Referenced by CVE · weakness (1)

  • CVE-2018-6334 Multipart-file uploads call variables to be improperly registered in the global scope. vulnerability

Referenced by CWE · has member (1)