CWE-94 对生成代码的控制不恰当(代码注入) 类弱点 1450 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-94 指代码注入漏洞，属于输入验证缺陷。攻击者通过向程序提供恶意构造的外部输入，利用未正确过滤的特殊字符或代码片段，篡改预期代码逻辑或注入可执行指令，从而劫持系统控制权。开发者应避免直接拼接用户输入，采用白名单验证机制，并使用参数化查询或沙箱环境隔离执行上下文，确保输入数据的合法性与安全性，从根本上阻断恶意代码的注入路径。
$MessageFile = "messages.out"; if ($_GET["action"] == "NewMessage") { $name = $_GET["name"]; $message = $_GET["message"]; $handle = fopen($MessageFile, "a+"); fwrite($handle, "<b>$name</b> says '$message'<hr>\n"); fclose($handle); echo "Message Saved!<p>\n"; } else if ($_GET["action"] == "ViewMessages") { include($MessageFile); }name=h4x0r message=%3C?php%20system(%22/bin/ls%20-l%22);?%3Euse CGI qw(:standard); sub config_file_add_key { my ($fname, $key, $arg) = @_; # code to add a field/key to a file goes here } sub config_file_set_key { my ($fname, $key, $arg) = @_; # code to set key to a particular file goes here } sub config_file_delete_key { my ($fname, $key, $arg) = @_; # code to delete key from a particular file goes here } sub handleConfigAction { my ($fname, $action) = @_; my $key = param('key'); my $val = param('val'); # this is super-efficient code, especially if you have to invoke # any one of dozens of different functions! my $code = "config_file_$action_key(\$fnamadd_key(",","); system("/bin/ls");| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2017-16020 | Summit 安全漏洞 — summit node module | 9.8 | - | 2018-06-04 |
| CVE-2017-16042 | Growl 安全漏洞 — growl node module | 9.8 | - | 2018-06-04 |
| CVE-2014-10065 | remarkable 跨站脚本漏洞 — remarkable node module | 6.1 | - | 2018-05-31 |
| CVE-2016-10546 | PouchDB 安全漏洞 — pouchdb node module | 9.8 | - | 2018-05-31 |
| CVE-2016-10548 | reduce-css-calc node模块安全漏洞 — reduce-css-calc node module | 6.1 | - | 2018-05-31 |
| CVE-2018-1273 | Pivotal Software Spring Data Commons和Spring Data REST 输入验证错误漏洞 — Spring Framework | 9.8 | - | 2018-04-11 |
| CVE-2018-1275 | Pivotal Spring Framework 安全漏洞 — Spring Framework | 9.8 | - | 2018-04-11 |
| CVE-2018-1270 | Pivotal Software Spring Framework 代码注入漏洞 — Spring Framework | 9.8 | - | 2018-04-06 |
| CVE-2017-1001002 | Math.js JavaScript引擎安全漏洞 — math.js | 9.8 | - | 2017-11-27 |
| CVE-2017-1001004 | typed-function JavaScript引擎安全漏洞 — typed-function | 8.8 | - | 2017-11-27 |
CWE-94（对生成代码的控制不恰当(代码注入)） 是常见的弱点类别，本平台收录该类弱点关联的 1450 条 CVE 漏洞。