1297 vulnerabilities classified as CWE-285 (授权机制不恰当). AI Chinese analysis included.
CWE-285 represents a critical access control weakness where an application fails to verify whether a user possesses the necessary permissions to access a specific resource or execute a particular action. Attackers typically exploit this vulnerability by manipulating request parameters, such as changing user IDs in URLs or API calls, to bypass security checks and access data belonging to other users or perform administrative tasks. This often leads to severe data breaches or unauthorized system modifications. To prevent such flaws, developers must implement robust, centralized authorization mechanisms that consistently validate user privileges for every sensitive operation. Relying solely on client-side checks is insufficient; instead, server-side enforcement using role-based or attribute-based access control ensures that only authenticated and authorized entities can interact with protected resources, thereby maintaining strict integrity and confidentiality.
function runEmployeeQuery($dbName, $name){ mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName); //Use a prepared statement to avoid CWE-89 $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name'); $preparedStatement->execute(array(':name' => $name)); return $preparedStatement->fetchAll(); } /.../ $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);sub DisplayPrivateMessage { my($id) = @_; my $Message = LookupMessageObject($id); print "From: " . encodeHTML($Message->{from}) . "<br>\n"; print "Subject: " . encodeHTML($Message->{subject}) . "\n"; print "<hr>\n"; print "Body: " . encodeHTML($Message->{body}) . "\n"; } my $q = new CGI; # For purposes of this example, assume that CWE-309 and # CWE-523 do not apply. if (! AuthenticateUser($q->param('username'), $q->param('password'))) { ExitError("invalid username or password"); } my $id = $q->param('id'); DisplayPrivateMessage($id);Vulnerabilities classified as CWE-285 (授权机制不恰当) represent 1297 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.