CWE-94 对生成代码的控制不恰当(代码注入) 类弱点 1449 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-94 指代码注入漏洞，属于输入验证缺陷。攻击者通过向程序提供恶意构造的外部输入，利用未正确过滤的特殊字符或代码片段，篡改预期代码逻辑或注入可执行指令，从而劫持系统控制权。开发者应避免直接拼接用户输入，采用白名单验证机制，并使用参数化查询或沙箱环境隔离执行上下文，确保输入数据的合法性与安全性，从根本上阻断恶意代码的注入路径。
$MessageFile = "messages.out"; if ($_GET["action"] == "NewMessage") { $name = $_GET["name"]; $message = $_GET["message"]; $handle = fopen($MessageFile, "a+"); fwrite($handle, "<b>$name</b> says '$message'<hr>\n"); fclose($handle); echo "Message Saved!<p>\n"; } else if ($_GET["action"] == "ViewMessages") { include($MessageFile); }name=h4x0r message=%3C?php%20system(%22/bin/ls%20-l%22);?%3Euse CGI qw(:standard); sub config_file_add_key { my ($fname, $key, $arg) = @_; # code to add a field/key to a file goes here } sub config_file_set_key { my ($fname, $key, $arg) = @_; # code to set key to a particular file goes here } sub config_file_delete_key { my ($fname, $key, $arg) = @_; # code to delete key from a particular file goes here } sub handleConfigAction { my ($fname, $action) = @_; my $key = param('key'); my $val = param('val'); # this is super-efficient code, especially if you have to invoke # any one of dozens of different functions! my $code = "config_file_$action_key(\$fnamadd_key(",","); system("/bin/ls");CWE-94（对生成代码的控制不恰当(代码注入)） 是常见的弱点类别，本平台收录该类弱点关联的 1449 条 CVE 漏洞。