ソスyソスソスソスpソスKソスCソスhソスz

CWE-94

Weakness ID:94(Weakness Class)

Status: Draft

ソスRソス[ソスhソスEソスCソスソスソスWソスFソスNソスVソスソスソスソス

ソスソスソス

ソスソスソスソスvソスソス

ソスソスハコソスソスソス|ソス[ソスlソスソスソスgソスソスソスソスフ影ソスソスソスソスソスソスソスソスソスソスヘゑソスソスgソスpソスソスソスソスソスRソス[ソスhソスZソスOソスソスソスソスソスgソスフ全ソスソスソスAソスソスソスソスソスソスソスヘ一部ソスソスソス\ソスzソスソスソスソス\ソスtソスgソスEソスFソスAソスノゑソスソスソスソスト、ソスモ図ソスソスソスソスOSソスRソス}ソスソスソスhソスフ構ソスソスソスソスモゑソスワゑソスソスソスソスソスソスソスソスするこソスニゑソスソスツ能ソスネ要ソスfソスソスKソスリに厄ソスソスソスソスソスソスソスソスネゑソスソス謔、ソスノゑソスソスソスニ弱性ソスナゑソスソスB

ソスレ細な会ソスソス

ソス\ソスtソスgソスEソスFソスAソスソスソスソスソス[ソスUソスソスソスヘにコソス[ソスhソスソスソスワめるこソスニゑソスソスソスソスツゑソスソスソス鼾ソスAソスモ図ソスソスソスソスソスソスソスソスtソスソスソス[ソスソスソスソスソスソスソスさゑソス體呻ソスフ包ソスソス@ソスノゑソスソスAソスUソスソスソスメにゑソスソスRソス[ソスhソスソスソス成ソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスBソスソスソスソスノゑソスソスAソスCソスモのコソス[ソスhソスソスソスソスソスsソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソスCソスソスソスWソスFソスNソスVソスソスソスソスソスフ厄ソスソスヘ様ソスXソスネ脆弱性ソスソスソスワみ、ソスホ擾ソスソスソスソスソスソスソス黷シソスソス蛯ォソスソスソスルなゑソスワゑソスソスBソスソスソスソスソスソスソスAソスSソストのイソスソスソスWソスFソスNソスVソスソスソスソスソスフ厄ソスソスヘ、ソスソスソス[ソスUソスフ難ソスソスヘに撰ソスソスソスpソスフコソス[ソスhソスソス}ソスソスソスソスソス驍アソスニゑソスソスツ能ソスナゑソスソスソスニゑソスソスソスソスソスソスハ点ソスソスソスソスソスソスソスワゑソスソスBソスoソスbソスtソス@ソスIソス[ソスoソス[ソスtソスソスソス[ソスソスソスフ托ソスソスフ脆弱性ソスヘ、ソスUソスソスソス成鯉ソスソスソスソスソスソス驍スソス゚にはソソスtソスgソスEソスFソスAソスソスフ鯉ソスソスラゑソスソスKソスvソスナゑソスソスBソスソスソスソスソスソスソスAソスCソスソスソスWソスFソスNソスVソスソスソスソスソスフ脆弱性ソスヘソソスtソスgソスEソスFソスAソスフ鯉ソスソスラに依托ソスソスソスソスソスソスAソスソスソスソスネ擾ソスソスソスソスソスソスソスソスpソスソスソス驍アソスニで攻ソスソスソスソスソスソスソスソスソスソスソスワゑソスソスBソスソスソスフ脆弱性ソスフカソスeソスSソスソスソスノゑソスソスソスソスソスナゑソスソスTソス^ソスIソスネ暦ソスニゑソスソスト、SQL ソスCソスソスソスWソスFソスNソスVソスソスソスソスソスソスソスソスム擾ソスソスソスソスソスソスソスソスソスフ厄ソス閧ェソスソスソスソスワゑソスソスB

ソスニ弱性ソスフ費ソスソスソスソスソスソスソス

ソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計
ソスソスソスソス

ソスYソスソスソスソスソスソスvソスソスソスbソスgソスtソスHソス[ソスソス

ソスソスソスソス

ソスCソスソスソス^ソス[ソスvソスソスソス^ソス^ソスソスソスソス

ソスソスハ的ソスネ影ソスソス

ソス@ソスソスソスソス

ソス}ソスソスソスソスソス黷スソスRソス[ソスhソスノゑソスソスAソスソスソスソスソスソスソス黷スソスfソス[ソス^ソスソスソスソスムフソス@ソスCソスソスソスノアソスNソスZソスXソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソスFソスソス

ソス}ソスソスソスソスソス黷スソスRソス[ソスhソスノゑソスソスAソスFソスリゑソスソスソスソス艪ウソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスBソスソスソスソスノゑソスソスAソスソスソスソスソス[ソスgソスフ脆弱性ソスソスソスソスソスソスソスソスソス黷ェソスソスソスソスワゑソスソスB

ソスAソスNソスZソスXソスソスソスソス

ソス}ソスソスソスソスソス黷スソスRソス[ソスhソスノゑソスソスAソス{ソスソスソスUソスソスソスメゑソスソスソスソスレアソスNソスZソスXソスソスソスソスソスソスソスソスソスソスソスネゑソスソスソスソス\ソス[ソスXソスノアソスNソスZソスXソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソスソスソスSソスソス

ソスソスソスソスfソス[ソス^ソスフ挿ソスソスソスヘ、ソスソスノデソス[ソス^ソスフ読み出ソスソスソス竢托ソスソスソスソスソスンを伴ゑソスソスソスソス゚、ソスルぼ全ソストのコソス[ソスhソスCソスソスソスWソスFソスNソスVソスソスソスソスソスUソスソスソスヘデソス[ソス^ソスフ奇ソスソスSソスソスソス損ゑソスソスワゑソスソスBソスソスソスソスソスト、ソスCソスモのコソス[ソスhソスソスソスソスソスsソスソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソスソスソスソスソスモ任

ソス}ソスソスソスソスソス黷スソスRソス[ソスhソスノゑソスソスソスソスsソスソスソス黷スソスAソスNソスVソスソスソスソスソスヘ、ソスソスソスOソスノ搾ソスソスユゑソスソスcソスソスネゑソスソス鼾ソスソスソスソスソスソスワゑソスソスB

ソスUソスソスソスソスソスけゑソスツ能ソスソス

ソスソス

ソスニ趣ソスネコソス[ソスhソスソス

ソスソス 1:

 

ソスネ会ソスソスフ暦ソスヘ、ソスソスソスbソスZソス[ソスWソスtソス@ソスCソスソスソスノソスソス[ソスUソスフソスソスbソスZソス[ソスWソスソスソスソスソスソスソスソスソスン、ソスソスソス[ソスUソスノゑソスソスフソスソスbソスZソス[ソスWソスフ閲ソスソスソスソスソスソスソスツゑソスソスソスソスソスフでゑソスソスB

ソスTソスソスソスvソスソスソスソスソスソスF PHP ソスiソスソスソスソスソスソスj
$MessageFile = "cwe-94/messages.out";
if ($_GET["action"] == "NewMessage") {
$name = $_GET["name"];
$message = $_GET["message"];
$handle = fopen($MessageFile, "a+");
fwrite($handle, "<b>$name</b> says '$message'<hr>¥n");
fclose($handle);
echo "Message Saved!<p>¥n";
}
else if ($_GET["action"] == "ViewMessages") {
include($MessageFile);
}

MessageFile ソスヘ、ソスfソス[ソス^ソスフみゑソスソスワまゑソス驍アソスニゑソスzソス閧ウソスソストゑソスソスワゑソスソスソスソスAソスUソスソスソスメはソスソスbソスZソス[ソスWソスノ以会ソスソスフ様ソスネ難ソスソスヘゑソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソスiソスUソスソスソスj
name=h4x0r
message=%3C?php%20system(%22/bin/ls%20-l%22);?%3E

ソスソスソスフソスソスbソスZソス[ソスWソスヘ、ソスネ会ソスソスフ様ソスノデソスRソス[ソスhソスソスソスソスワゑソスソスB

ソスiソスUソスソスソスj
<?php system("/bin/ls -l");?>

ソス鼬ゥソスAソスハ擾ソスフデソス[ソス^ソスtソス@ソスCソスソスソスフ難ソスソスeソスニゑソスソスト挿ソスソスソスソスソスソスソス謔、ソスノ思ソスソスソスワゑソスソスソスソスAPHP ソスヘゑソスソスフデソス[ソス^ソスソスソスワんだフソス@ソスCソスソスソスソスソスソスヘゑソスソスRソス[ソスhソスソスソスソスソスsソスソスソスワゑソスソスBソスソスソスフコソス[ソスhソスヘ茨ソスハソスソス[ソスUソスソスソスソスソスbソスZソス[ソスWソスソスソス{ソスソスソスソスソスソスxソスノ趣ソスソスsソスソスソスソスワゑソスソスB

ソスソスソスフ様ソスネ状況会ソスソスナは、XSS (CWE-79) ソスUソスソスソスソスソスソスソスソスソスツ能ソスソスソスソスソスソスソス驍スソス゚抵ソスソスモゑソスソスKソスvソスナゑソスソスB

 

ソスソスQソスフ緩和ソスソス

ソスtソスFソス[ソスYソスFソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計

ソスソスソスIソスノコソス[ソスhソス生撰ソスソスソスソスネゑソスソス謔、ソスAソスvソスソスソスOソスソスソスソスソスソスソスソスソスtソス@ソスNソス^ソスソスソスソスソスOソスソスソスト会ソスソスソスソスソスソスB

ソスtソスFソス[ソスYソスFソスAソス[ソスLソスeソスNソス`ソスソスソスソスソスソスム設計

ソスvソスソスソスZソスXソスニオソスyソスソスソス[ソスeソスBソスソスソスOソスVソスXソスeソスソスソスフ間で鯉ソスソスdソスネ具ソスソスEソスソスソスソスソスソスソスソスソスソス "jail" ソスソスAソズ趣ソスソスソスソスソスTソスソスソスhソス{ソスbソスNソスXソスツ具ソスソスフ抵ソスソスナコソス[ソスhソスソスソスソスソスsソスソスソストゑソスソスソスソスソスソスソスソスBソスソスソスソスノゑソスソスAソス\ソスtソスgソスEソスFソスAソスソスナ趣ソスソスsソスソスソスソスソスツ能ソスソスソスフゑソスソスソスRソス[ソスhソスソスソスソスソスハ的ソスノ撰ソスソスソスソスツ能ソスナゑソスソスB

ソスソスニゑソスソスト、Unix chroot jail ソスyソスソス AppArmor ソスソスソスソスソスソスソスソスソスワゑソスソスBソスソスハ的ソスノ、ソスRソス[ソスhソスフ管暦ソスソスノゑソスソスAソスソスソスソスソスツゑソスソスフ保鯉ソス@ソス\ソスソスソス供ゑソスソスソスワゑソスソスB
ソスソスソスソスヘ、ソスモゑソスソスしソスソスソスソスソスソスソスソスナはなゑソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスBソスワゑソスソスAソスIソスyソスソスソス[ソスeソスBソスソスソスOソスVソスXソスeソスソスソスヨの費ソスQソスソスソスソスソス閧キソス驍セソスソスソスナゑソスソスソスAソスcソスソスフアソスvソスソスソスPソス[ソスVソスソスソスソスソスヘ侵ソスQソスフ対象のままでゑソスソスB

CWE-243 ソスyソスムゑソスソスフ托ソスソスソス jail ソスノ関連ソスソスソスソスニ弱性ソスフ会ソスソスソスノは抵ソスソスモゑソスソストゑソスソスソスソスソスソスソスソスB

ソスtソスFソス[ソスYソスFソスソスソスソス

ソス略ソスF ソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスN
ソスSソストの難ソスソスヘは茨ソスソスモのゑソスソスソスソスソスフと想ソス閧オソストゑソスソスソスソスソスソスソスソスBソスdソスlソスノ鯉ソスソスソスソスノ従ソスソスソスソスソスツゑソスソスソスソスソスヘのホソスソスソスCソスgソスソスソスXソスgソスソスソスgソスpソスソスソス體呻ソスAソスソスソスmソスフ受け難ソスソスソスソスソストゑソスソスソスソスソスヘの妥難ソスソスソスソス`ソスFソスbソスNソスソス@ソスソスpソスソスソストゑソスソスソスソスソスソスソスソスBソスdソスlソスノ費ソスソスソスソスソスソスソスヘゑソスソスソスソスロゑソスソスソスAソスソスソス驍「ソスヘ難ソスソスヘゑソスソスdソスlソスノ適ソスソスソスソスソスソス`ソスノ変会ソスソスソスソスソスソストゑソスソスソスソスソスソスソスソスBソスuソスソスソスbソスNソスソスソスXソスgソスノ依托ソスソスソスソストゑソスソスワゑソスソスソスソスAソスソスソスモのゑソスソスソスAソスソスソス驍「ソスヘ不ソスソスソスネ難ソスソスヘゑソスTソスソスソスソスソスニのみに依托ソスソスソスソスネゑソスソスナゑソスソスソスソスソスソスソスソスBソスソスソスソスソスソスソスAソスuソスソスソスbソスNソスソスソスXソスgソスヘ予ソスソスソスソスソスソスソスUソスソスソスフ鯉ソスソスmソスソスAソスソスソスソスソスソスソスノ具ソスソスロゑソスソスソスラゑソスソスsソスソスソスネ難ソスソスヘゑソスソスソスソス閧キソスソスロに役立ゑソスソスワゑソスソスB

ソスソスソスヘ値ソスフ妥難ソスソスソスソスソスソス`ソスFソスbソスNソスソスソスソスロ、ソスヨ連ソスソスソスソスソスソスソスネ全ソストの要ソスfソスiソスソスソスソスソスAソスソスソスヘタソスCソスvソスAソスソスソスeソスソスソスソスlソスフ範囲、ソスソスソスヘの過不ソスソスソスAソス\ソスソスソスAソスヨ連ソスソスソスソスtソスBソス[ソスソスソスhソスヤの茨ソスム撰ソスソスAソスyソスムビソスWソスlソスXソスソスソス[ソスソスソスフ茨ソスvソスAソスソスソスjソスノつゑソスソスト考ソスソスソスソスソストゑソスソスソスソスソスソスソスソスBソスrソスWソスlソスXソスソスソス[ソスソスソスフ暦ソスニゑソスソスト、"boat" ソスヘ英ソスソスソスソスソスソスソスソスソスワまなゑソスソスソスソス゚構ソスソスソスIソスノ有ソスソスソスナゑソスソスソスソスAソスソスソスソスソスJソスソスソスメゑソス "red" ソスソス "blue" ソスフようソスネ色ソスフ厄ソスソスOソスソスzソス閧キソスソス鼾ソスノは有ソスソスソスナはなゑソスソスAソスニゑソスソスソスソスソスソスWソスbソスNソスソスソスソスソスソスソスソスソスワゑソスソスB

ソズ趣ソスソスソスソスソスRソス[ソスhソスCソスソスソスWソスFソスNソスVソスソスソスソスソスソスソスソスソスソスソスソスソスソスソス驍スソス゚に、ソスソスソスツゑソスソスソス\ソスソスソスソスソスソスソスソスソスソスソスソスソスソスソスソスソスソスソスzソスソスソスCソスgソスソスソスXソスgソスソスソスgソスpソスソスソストゑソスソスソスソスソスソスソスソスBソスヨ撰ソスソスソスソストび出ソスソスソスRソス[ソスhソス動的ソスノ構ソスzソスソスソストゑソスソスソス鼾ソスヘ、ソスpソスソスソスソスソスフみの難ソスソスヘでは不ソス\ソスソスソスネ可能ソスソスソスソスソスソスソス驍アソスニゑソスソスmソスFソスソスソストゑソスソスソスソスソスソスソスソスBソスUソスソスソスメにゑソスソスAソスソスソスツゑソスソスソスツゑソスソスソスフなゑソスソス険ソスネ関撰ソス(system()ソスAexec()ソスAexit()ソスソス)ソスソスソスQソスニゑソスソスソスソスツ能ソスソスソスソスソスソスソスソスワゑソスソスB

ソスtソスFソス[ソスYソスFソスeソスXソスg

ソス{ソスニ弱性ソスソスソスソスソスoソスツ能ソスネ趣ソスソスソスソステ的ソスソスソスヘツソス[ソスソスソスソスソスgソスpソスソスソストゑソスソスソスソスソスソスソスソスBソスナ近の托ソスソスソスソスフ趣ソス@ソスヘ、ソスtソスHソス[ソスソスソスXソス|ソスWソスeソスBソスuソスソスソスナ擾ソスソスソスソスソスソス驍スソス゚にデソス[ソス^ソスtソスソスソス[ソスソスソスヘゑソスソスgソスpソスソスソストゑソスソスワゑソスソスBソスソスソスソスソスソスソスcソス[ソスソスソスノゑソス骭滂ソスoソスナゑソス 100% ソスフ撰ソスソスxソスソスJソスoソス[ソスヘ趣ソスソスソスソスsソスツ能ソスナゑソスソス驍スソス゚、ソスソスソスソスソスネ会ソスソスソスソスソスニはなゑソスワゑソスソスソスB

ソスtソスFソス[ソスYソスFソスeソスXソスg

ソスtソス@ソスYソスeソスXソスg(ソスtソス@ソスWソスソスソスO)ソスAソスソスソスoソスXソスgソスlソスXソスeソスXソスg(ソス謖抵ソスソスソスフテソスXソスg)ソスソスAソスtソスHソス[ソスソスソスgソスCソスソスソスWソスFソスNソスVソスソスソスソス(ソスGソスソスソス[ソスソスソスざソスニ起ソスソスソスソスソスeソスXソスg)ソスソスソスAソスソスソス多ソスlソスネ難ソスソスヘゑソスソスソスソスツ膨ソスソスネテソスXソスgソスPソス[ソスXソスソスソスgソスpソスソスソストソソスtソスgソスEソスFソスAソス分析ゑソスソスソスAソスソスソスIソスネツソス[ソスソスソスソスZソスpソスソスソスgソスpソスソスソストゑソスソスソスソスソスソスソスソスBソス\ソスtソスgソスEソスFソスAソスフ擾ソスソスソスソスソスソスxソスヘ低下ソスソスソスワゑソスソスソスソスAソスソスソスソスソスソスソスsソスソスソスソスノなゑソスソスソスソスソスAソスNソスソスソスbソスVソスソスソスソスソスソスAソスsソスソスソスmソスネ鯉ソスソスハゑソスソスoソスソスソスニゑソスソスソスソスソスソスソスソスニはゑソスソスソスワゑソスソスソスB

ソスtソスFソス[ソスYソスFソスIソスyソスソスソス[ソスVソスソスソスソス

ソス略ソスF ソスRソスソスソスpソスCソスソスソスAソスrソスソスソスhソスフ具ソスソスソス
Perl ソスソス ソスu-Tソスv ソスXソスCソスbソス`ソスソスソスAソスソスソスソスソスソスソスoソス@ソス\ソスソスソスソスソスソスソスソスソスsソスソスソスAソスソスソスソスソスソスソス黷スソスマ撰ソスソスソスソスワむコソス}ソスソスソスhソスフ趣ソスソスsソスソスhソスソスソスツ具ソスソスナコソス[ソスhソスソスソスソスソスsソスソスソスト会ソスソスソスソスソスソスBソスソスソスソスト危険ソスソスソスソスソスソスソスソスソスソスヘに対ゑソスソスト、ソスソスソスソスソスソスソスソストゑソスソスネゑソスソスニゑソスソスソスソスがつゑソスソスネゑソスソス謔、ソスノ撰ソスソスmソスノ難ソスソスヘの妥難ソスソスソスソスソスソスmソスFソスソスソスソス謔、ソスノ抵ソスソスモゑソスソスネゑソスソスソスホなゑソスワゑソスソスが、ソスソスソスソスソスソスソス黷スソスマ撰ソスソスソスソスソス闖懶ソスソスソスソスソス゚の妥難ソスソスソスソスソスソスmソスFソスソスソスソスXソスeソスbソスvソスソスソスソスソスソスソスIソスノ趣ソスソスsソスソスソスト会ソスソスソスソスソスソスBソスiCWE-183ソスACWE-184ソスソスソスソスソスQソスニ会ソスソスソスソスソスソスj

ソスヨ係ソスソス

 

Nature Type ID Name View(s) this relationship pertains to
ChildOf Weakness Class 74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Development Concepts (primary)699
Research Concepts (primary)1000
ChildOf Weakness Class 691 Insufficient Control Flow Management Research Concepts1000
ChildOf Category 752 2009 Top 25 - Risky Resource Management Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors (primary)750
ParentOf Weakness Base 95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') Development Concepts (primary)699
Research Concepts (primary)1000
ParentOf Weakness Base 96 Insufficient Control of Directives in Statically Saved Code (Static Code Injection) Development Concepts (primary)699
Research Concepts (primary)1000
ParentOf Weakness Base 621 Variable Extraction Error Research Concepts (primary)1000
ParentOf Weakness Base 627 Dynamic Variable Evaluation Development Concepts (primary)699
Research Concepts (primary)1000
MemberOf View 635 Weaknesses Used by NVD Weaknesses Used by NVD (primary)635
CanFollow Compound Element: Composite 98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP File Inclusion') Development Concepts699
Research Concepts (primary)1000

 

ソスvソスソスソスソスソスソスソスソス ソスiCWE ソスフ鯉ソスソスソスソスj

ソス{ソスニ弱性ソスフ托ソスソスソスソスヘ鯉ソスソスソスソスソスソスソスソスソスム抵ソスソスソスソスソスソスナゑソスソスソスAソスニ弱性ソスフ厄ソスソスフゑソスソスソスソスPソスフ余ソスnソスソスソスソスソスソスワゑソスソスB

ソスソスソスgソスDソスナの包ソスソスソス

 

ソスgソスDソスソスソスワゑソスソスヘ組ソスDソスナの包ソスソスソス ソスmソス[ソスh ID CWEソスフ包ソスソズとの適ソスソスソスx ソスソスソズ厄ソス
PLOVER CODE Code Evaluation and Injection

 

ソスヨ連ソスソスソスソスUソスソスソスpソス^ソス[ソスソス

 

CAPEC-ID ソスUソスソスソスpソス^ソス[ソスソスソスソス (CAPEC Version 1.5)
35 Leverage Executable Code in Nonexecutable Files
77 Manipulating User-Controlled Variables

 

ソスXソスVソスソスソスソス

[2011ソスN04ソスソス21ソスソス]
  2010ソスN10ソスソス12ソスソスソスソスソス_ソスフデソス[ソス^ソスソスソスソスソスノ更ソスV
[2009ソスN06ソスソス29ソスソス]
  2009ソスN02ソスソス02ソスソスソスソスソス_ソスフ会ソスソスL URL ソスソスソスソスソスノ作成
    http://cwe.mitre.org/data/definitions/94.html


ソスoソス^ソスソス 2011/04/21

ソスナ終ソスXソスVソスソス 2023/04/04


OSZAR »