2064 vulnerabilities classified as CWE-94 (对生成代码的控制不恰当(代码注入)). AI Chinese analysis included.
CWE-94 represents a critical code injection weakness where software constructs executable code using untrusted input without proper sanitization. Attackers typically exploit this vulnerability by injecting malicious scripts or commands into user-supplied fields, such as web forms or API parameters, which the application then executes directly. This allows adversaries to bypass security controls, steal sensitive data, or gain unauthorized administrative access to the underlying system. To prevent such exploits, developers must rigorously validate and sanitize all external inputs, ensuring that only expected characters are processed. Implementing strict allow-listing strategies, utilizing parameterized queries for database interactions, and avoiding dynamic code execution functions like eval() are essential defensive measures. By treating all user input as potentially hostile and applying robust encoding techniques, organizations can effectively neutralize injection vectors and maintain application integrity.
$MessageFile = "messages.out"; if ($_GET["action"] == "NewMessage") { $name = $_GET["name"]; $message = $_GET["message"]; $handle = fopen($MessageFile, "a+"); fwrite($handle, "<b>$name</b> says '$message'<hr>\n"); fclose($handle); echo "Message Saved!<p>\n"; } else if ($_GET["action"] == "ViewMessages") { include($MessageFile); }name=h4x0r message=%3C?php%20system(%22/bin/ls%20-l%22);?%3Euse CGI qw(:standard); sub config_file_add_key { my ($fname, $key, $arg) = @_; # code to add a field/key to a file goes here } sub config_file_set_key { my ($fname, $key, $arg) = @_; # code to set key to a particular file goes here } sub config_file_delete_key { my ($fname, $key, $arg) = @_; # code to delete key from a particular file goes here } sub handleConfigAction { my ($fname, $action) = @_; my $key = param('key'); my $val = param('val'); # this is super-efficient code, especially if you have to invoke # any one of dozens of different functions! my $code = "config_file_$action_key(\$fnamadd_key(",","); system("/bin/ls");Vulnerabilities classified as CWE-94 (对生成代码的控制不恰当(代码注入)) represent 2064 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.