CWE-621 (变量抽取错误) — Vulnerability Class 1

CWE-621 represents a critical input validation weakness where software dynamically assigns external user input to variable names without verifying their legitimacy. This flaw typically allows attackers to manipulate program state by injecting malicious identifiers, effectively overwriting unintended variables or injecting arbitrary data into the application’s memory space. In languages like PHP, this vulnerability mimics the dangers of deprecated features such as register_globals, enabling attackers to bypass security controls and execute unauthorized operations. To mitigate this risk, developers must strictly sanitize and validate all external inputs before using them as variable identifiers. Implementing allowlists for permissible variable names, avoiding dynamic variable assignment from untrusted sources, and enforcing strict type checking are essential practices. By ensuring that only predefined, safe variables are accessible, developers can prevent unintended state modifications and maintain application integrity against exploitation attempts.