CWE-115 (输入的错误解释) — Vulnerability Class 22

CWE-115 represents a critical input validation weakness where software incorrectly interprets data, often due to encoding mismatches or improper parsing logic. Attackers typically exploit this by crafting malicious inputs that bypass security controls, such as using double-encoding to evade filters or manipulating character sets to inject code. This misinterpretation can lead to severe vulnerabilities like cross-site scripting or SQL injection, as the application processes the data differently than intended. To prevent these issues, developers must implement strict input validation and normalization strategies. Ensuring consistent encoding standards throughout the data pipeline is essential. Additionally, using parameterized queries and context-aware output encoding helps mitigate risks by treating all input as untrusted until explicitly validated, thereby closing the gap between perceived and actual data structure.