CWE-616 (上传文件变量的不完整标识(PHP)) — Vulnerability Class 1

CWE-616 represents a critical input validation weakness in PHP applications that rely on legacy file upload handling mechanisms. This vulnerability arises when developers directly reference global variables, such as $varname or $varname_name, which are automatically populated by the PHP engine upon file submission. Attackers typically exploit this flaw by manipulating HTTP requests, including POST data, cookies, or headers, to overwrite these sensitive global variables. By injecting malicious filenames or MIME types, adversaries can trick the application into processing unauthorized files, potentially leading to remote code execution or file inclusion attacks. To mitigate this risk, developers must avoid using these deprecated global variables entirely. Instead, they should utilize the secure $_FILES superglobal array, which provides a controlled and validated interface for accessing uploaded file metadata, thereby ensuring that file attributes cannot be tampered with through external request manipulation.