CWE-349 (在可信数据中接受外来的不可信数据) — Vulnerability Class 28

CWE-349 represents a critical input validation weakness where software incorrectly processes untrusted data embedded alongside trusted inputs, treating the malicious elements as legitimate. Attackers typically exploit this by injecting harmful payloads, such as SQL commands or script tags, into fields that are otherwise expected to contain safe, verified information. Because the application fails to distinguish between the two data sources, it executes the untrusted content, leading to severe vulnerabilities like injection attacks or data corruption. Developers can prevent this by implementing strict input sanitization and validation routines that isolate and verify each data component independently. By explicitly defining allowed formats and rejecting any unexpected characters or structures, even those hidden within trusted streams, engineers ensure that only verified, safe data influences the application’s logic, thereby maintaining system integrity.