36 vulnerabilities classified as CWE-706 (使用不正确的解析名称或索引). AI Chinese analysis included.
CWE-706 represents a critical input validation weakness where a software system incorrectly resolves a name or reference, leading to access of resources outside its intended control sphere. This vulnerability typically arises when applications fail to properly sanitize or validate user-supplied identifiers, allowing attackers to manipulate references to point to unauthorized files, database entries, or network endpoints. Exploitation often involves path traversal or pointer manipulation, enabling unauthorized data access, privilege escalation, or system compromise by redirecting operations to sensitive areas. To mitigate this risk, developers must implement strict input validation, ensuring all references are checked against a whitelist of allowed values. Additionally, using canonicalization techniques to normalize paths before resolution and employing least-privilege principles for resource access can significantly reduce the attack surface, ensuring that resolved references remain within the expected and secure boundaries of the application’s operational environment.
$dir = $_GET['module_name']; include($dir . "/function.php");victim.php?module_name=http://malicious.example.comimport os import sys def main(): filename = sys.argv[1] path = os.path.join(os.getcwd(), filename) try: with open(path, 'r') as f: file_data = f.read() except FileNotFoundError as e: print("Error - file not found") main()import os import sys def main(): filename = sys.argv[1] path = os.path.normpath(f"{os.getcwd()}{os.sep}{filename}") if path.startswith("/home/cwe/documents/"): try: with open(path, 'r') as f: file_data = f.read() except FileNotFoundError as e: print("Error - file not found") main()Vulnerabilities classified as CWE-706 (使用不正确的解析名称或索引) represent 36 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.