174 vulnerabilities classified as CWE-95 (动态执行代码中指令转义处理不恰当(Eval注入)). AI Chinese analysis included.
CWE-95 represents a critical code injection vulnerability where software fails to properly sanitize user-supplied input before passing it to a dynamic evaluation function, such as JavaScript’s eval(). Attackers typically exploit this weakness by injecting malicious code snippets into the input stream, which the application then executes with the privileges of the running process. This can lead to complete system compromise, data exfiltration, or unauthorized administrative actions. To mitigate this risk, developers must strictly avoid using dynamic code execution functions whenever possible, opting instead for safer alternatives like JSON parsing or predefined function mappings. When dynamic evaluation is unavoidable, rigorous input validation and strict whitelisting of allowed characters are essential to ensure that only safe, expected data structures are processed, thereby neutralizing potential injection vectors before they reach the interpreter.
use CGI qw(:standard); sub config_file_add_key { my ($fname, $key, $arg) = @_; # code to add a field/key to a file goes here } sub config_file_set_key { my ($fname, $key, $arg) = @_; # code to set key to a particular file goes here } sub config_file_delete_key { my ($fname, $key, $arg) = @_; # code to delete key from a particular file goes here } sub handleConfigAction { my ($fname, $action) = @_; my $key = param('key'); my $val = param('val'); # this is super-efficient code, especially if you have to invoke # any one of dozens of different functions! my $code = "config_file_$action_key(\$fnamadd_key(",","); system("/bin/ls");def main(): sum = 0 try: numbers = eval(input("Enter a comma-separated list of numbers: ")) except SyntaxError: print("Error: invalid input") return for num in numbers: sum = sum + num print(f"Sum of {numbers} = {sum}") main()__import__('subprocess').getoutput('rm -r *')Vulnerabilities classified as CWE-95 (动态执行代码中指令转义处理不恰当(Eval注入)) represent 174 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.