CWE-627
Dynamic Variable Evaluation
AI Translation Available
In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
Status
incomplete
Abstraction
variant
Affected Platforms
Perl
PHP
Extended Description
AI Translation
The resultant vulnerabilities depend on the behavior of the application, both at the crossover point and in any control/data flow that is reachable by the related variables or functions.
Technical Details
AI Translation
Common Consequences
confidentiality
integrity
availability
Impacts
modify application data
execute unauthorized code or commands
Potential Mitigations
Phases:
implementation
Descriptions:
•
Use only allowlists of acceptable variable or function names.
•
Refactor the code to avoid dynamic variable evaluation whenever possible.
•
For function names, ensure that you are only calling functions that accept the proper number of arguments, to avoid unexpected null arguments.