PHP External Variable Modification
CWE-473
A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
We track 4 vulnerabilities of this type. 75% are rated high or critical, and the average CVSS score is 8.4. 2 have been exploited in real attacks.
Latest PHP External Variable Modification vulnerabilities
- 8.8 High severity
WeGIA: Improper Neutralization of Special Elements used in an SQL Command
WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usuario POST parameter overwrites the session-stored user identity via extract($_REQUEST) in DespachoCon
- 9.8 Critical severity
WeGIA: Authentication Bypass Using an Alternate Path or Channel
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vulnerability can
- 9.8 Critical severity
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Exploited
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker i
- 5.3 Medium severity
Juniper Junos OS EX Series PHP External Variable Modification Exploited
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify c