{"@ID": "621", "@Name": "Variable Extraction Error", "@Abstraction": "Variant", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid.", "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "914", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "CanPrecede", "@CWE_ID": "471", "@View_ID": "1000"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": [{"@Name": "PHP", "@Prevalence": "Undetermined"}, {"@Class": "Interpreted", "@Prevalence": "Undetermined"}]}, "Alternate_Terms": {"Alternate_Term": {"Term": "Variable overwrite"}}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation"}}, "Common_Consequences": {"Consequence": [{"Scope": "Integrity", "Impact": "Modify Application Data", "Note": "An attacker could cause the program to overwrite unintended variables."}, {"Scope": "Integrity", "Impact": "Modify Application Data", "Note": "When using PHP, calling extract() or import_request_variables() without the proper arguments could allow arbitrary global variables to be overwritten, including superglobals."}]}, "Potential_Mitigations": {"Mitigation": [{"Phase": "Implementation", "Strategy": "Input Validation", "Description": "Use allowlists of variable names that can be extracted."}, {"Phase": "Implementation", "Strategy": "Refactoring", "Description": "Consider refactoring your code to avoid extraction routines altogether."}, {"Phase": "Implementation", "Description": "In PHP, call extract() with options such as EXTR_SKIP and EXTR_PREFIX_ALL; call import_request_variables() with a prefix argument. Note that these capabilities are not present in all PHP versions."}]}, "Demonstrative_Examples": {"Demonstrative_Example": {"@Demonstrative_Example_ID": "DX-107", "Intro_Text": "This code uses the credentials sent in a POST request to login a user. It used extract() to provide functionality similar to register_globals.", "Example_Code": {"@Nature": "Bad", "@Language": "PHP", "xhtml:div": {"xhtml:i": "//Log user in, and set $isAdmin to true if user is an administrator", "xhtml:br": [null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "#text": "$isAdmin = true;"}, "#text": "$query = buildQuery($user,$pass);mysql_query($query);if(getUserRole($user) == \"Admin\"){}"}, "#text": "function login($user,$pass){}\n                     $isAdmin = false;extract($_POST);login(mysql_real_escape_string($user),mysql_real_escape_string($pass));"}, "#text_blocks": ["//Log user in, and set $isAdmin to true if user is an administrator", "function login($user,$pass){", "$query = buildQuery($user,$pass);", "mysql_query($query);", "if(getUserRole($user) == \"Admin\"){", "$isAdmin = true;", "}", "}", "$isAdmin = false;", "extract($_POST);", "login(mysql_real_escape_string($user),mysql_real_escape_string($pass));"]}, "Body_Text": "The call to extract() will overwrite the existing values of any variables defined previously, in this case $isAdmin. An attacker can send a POST request with an unexpected third value \"isAdmin\" equal to \"true\", thus gaining Admin privileges."}}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2006-7135", "Description": "extract issue enables file inclusion", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-7135"}, {"Reference": "CVE-2006-7079", "Description": "Chain: PHP app uses extract for register_globals compatibility layer (CWE-621), enabling path traversal (CWE-22)", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-7079"}, {"Reference": "CVE-2007-0649", "Description": "extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect.", "Link": "https://www.cve.org/CVERecord?id=CVE-2007-0649"}, {"Reference": "CVE-2006-6661", "Description": "extract() enables static code injection", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-6661"}, {"Reference": "CVE-2006-2828", "Description": "import_request_variables() buried in include files makes post-disclosure analysis confusing", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-2828"}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": {"@Taxonomy_Name": "Software Fault Patterns", "Entry_ID": "SFP24", "Entry_Name": "Tainted input to command"}}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Notes": {"Note": {"@Type": "Research Gap", "#text": "Probably under-reported for PHP. Seems under-studied for other interpreted languages."}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2007-05-07", "Submission_Version": "Draft 6", "Submission_ReleaseDate": "2007-05-07"}, "Modification": [{"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Description, Relationships, Observed_Example, Other_Notes, Weakness_Ordinalities"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-10-14", "Modification_Version": "1.0.1", "Modification_ReleaseDate": "2008-10-14", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Common_Consequences, Demonstrative_Examples, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-10-30", "Modification_Version": "2.3", "Modification_ReleaseDate": "2012-10-30", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2013-02-21", "Modification_Version": "2.4", "Modification_ReleaseDate": "2013-02-21", "Modification_Comment": "updated Demonstrative_Examples, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-06-23", "Modification_Version": "2.7", "Modification_ReleaseDate": "2014-06-23", "Modification_Comment": "updated Description, Other_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-06-25", "Modification_Version": "4.1", "Modification_ReleaseDate": "2020-06-25", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-04-28", "Modification_Version": "4.7", "Modification_ReleaseDate": "2022-04-28", "Modification_Comment": "updated Research_Gaps"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships, Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-10-26", "Modification_Version": "4.13", "Modification_ReleaseDate": "2023-10-26", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-04-30", "Modification_Version": "4.20", "Modification_ReleaseDate": "2026-04-30", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description"}]}, "entry_type": "Weakness"}