Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CWE-74 (输出中的特殊元素转义处理不恰当(注入)) — Vulnerability Class 447

447 vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)). AI Chinese analysis included.

CWE-74 represents a critical input validation weakness where software constructs commands, data structures, or records using externally influenced input without properly neutralizing special elements. This flaw allows attackers to inject malicious syntax that alters the intended interpretation of the downstream component, leading to severe consequences such as unauthorized command execution, data manipulation, or system compromise. Exploitation typically occurs when user-supplied data is directly concatenated into queries or system calls without sanitization. To prevent this, developers must implement rigorous input validation, ensuring all external data is strictly checked against expected formats. Furthermore, utilizing parameterized queries, safe APIs, and context-specific encoding techniques ensures that special characters are treated as literal data rather than executable instructions, effectively neutralizing potential injection vectors before they reach the downstream processor.

MITRE CWE Description
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Common Consequences (5)
ConfidentialityRead Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Access ControlBypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
OtherAlter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
Integrity, OtherOther
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
Non-RepudiationHide Activities
Often the actions performed by injected control code are unlogged.
Mitigations (2)
RequirementsProgramming languages and supporting technologies might be chosen which are not subject to these issues.
ImplementationUtilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
Examples (2)
This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.
$userName = $_POST["user"]; $command = 'ls -l /home/' . $userName; system($command);
Bad · PHP
;rm -rf /
Attack
The following code segment reads the name of the author of a weblog entry, author, from an HTTP request and sets it in a cookie header of an HTTP response.
String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie);
Bad · Java
HTTP/1.1 200 OK ... Set-Cookie: author=Jane Smith ...
Result
CVE IDTitleCVSSSeverityPublished
CVE-2024-6469 playSMS Template injection — playSMS 2.7 Low2024-07-03
CVE-2024-38366 CoacoaPods trunk RCE in email verification system rfc-822 — CocoaPods 10.0 Critical2024-07-01
CVE-2024-36420 GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file — Flowise 7.5 High2024-07-01
CVE-2024-35728 WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerability — PPOM for WooCommerce 5.3 Medium2024-06-10
CVE-2024-5184 Prompt Injection in EmailGPT — EmailGPT 6.5 Medium2024-06-05
CVE-2023-23738 WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email Spoofing Vulnerability — Spectra 5.3 Medium2024-06-03
CVE-2024-34697 Freescout vulnerable to Stored HTML Injection in Editing Received Emails — freescout 7.6 High2024-05-13
CVE-2024-32986 Arbitrary code execution due to improper sanitization of web app properties in PWAsForFirefox — PWAsForFirefox 9.7 Critical2024-05-03
CVE-2024-34062 tqdm CLI arguments injection attack — tqdm 4.8 Medium2024-05-03
CVE-2024-28234 Contao has insufficient BBCode sanitizer — contao 4.3 Medium2024-04-09
CVE-2024-28191 Contao may have unencoded insert tags in the frontend — contao 3.1 Low2024-04-09
CVE-2024-3366 Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection — xxl-job 3.5 Low2024-04-06
CVE-2024-28867 Swift Prometheus un-sanitized metric name or labels can be used to take over exported metrics — swift-prometheus 5.9 Medium2024-03-29
CVE-2024-29896 Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections — astro-shield 7.5 High2024-03-28
CVE-2024-29027 Parse Server crash and RCE via invalid Cloud Function or Cloud Job name — parse-server 9.1 Critical2024-03-19
CVE-2024-23333 LAM vulnerable to Authenticated Remote Code Execution — lam 7.9 High2024-03-18
CVE-2024-2445 Reflected XSS in Mattermost Jira plugin — Mattermost 6.1 Medium2024-03-15
CVE-2024-28181 Arbitrary method invocation turbo_boost-commands — turbo_boost-commands 8.1 High2024-03-14
CVE-2024-28114 Remote Code Execution using Server Side Template Injection in Peering Manager — peering-manager 8.1 High2024-03-12
CVE-2024-21900 QTS, QuTS hero, QuTScloud — QTS 4.3 Medium2024-03-08
CVE-2024-21838 Gallagher Command Centre 安全漏洞 — Command Centre Server 6.8 Medium2024-03-05
CVE-2024-2064 rahman SelectCours Template CacheController.java getCacheNames injection — SelectCours 4.3 Medium2024-03-01
CVE-2024-1619 Kaspersky Security 安全漏洞 — Kaspersky Security for Linux Mail Server 8 6.1 Medium2024-02-29
CVE-2024-21742 Apache James Mime4J: Mime4J DOM header injection — Apache James Mime4J 5.3 -2024-02-27
CVE-2023-51388 HertzBeat AviatorScript Inject RCE — hertzbeat 9.8 Critical2024-02-22
CVE-2023-51653 Hertzbeat JMX JNDI RCE — hertzbeat 9.8 Critical2024-02-22
CVE-2024-23830 MantisBT Host Header Injection vulnerability — mantisbt 8.3 High2024-02-20
CVE-2024-1128 Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A — Tutor LMS – eLearning and online course solution 5.4 Medium2024-02-20
CVE-2024-25625 Pimcore Host Header Injection in user invitation link — admin-ui-classic-bundle 8.1 High2024-02-19
CVE-2024-22319 IBM Operational Decision Manager JDNI injection — Operational Decision Manager 8.1 High2024-02-02

Vulnerabilities classified as CWE-74 (输出中的特殊元素转义处理不恰当(注入)) represent 447 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.