CWE-626, Null Byte Interaction Error (Poison Null Byte), happens when data crosses between components that treat the NUL character differently. It affects PHP, Perl and ASP.NET code that calls into C functionality.
How it happens
In standard C libraries, a null byte terminates a string. Perl and PHP strings do not treat it that way. When a PHP script validates a string, then hands it to a C function, the two sides see different strings.
MITRE notes this is often used in path traversal: the attacker ends the filename early and cuts off a hard-coded extension the app appended.
// Vulnerable pattern: extension appended, input not cleaned
$page = $_GET['page']; // "../../etc/passwd%00"
include('/var/www/pages/' . $page . '.php');
The record also covers filters. CVE-2005-3153 let SQL follow a NUL byte and bypass an allowlist regular expression, enabling SQL injection.
What an attacker gains
The record lists an integrity impact: unexpected state. In practice, the checks you wrote no longer test what the lower layer receives.
How to find it
Automated static analysis can find some cases. Also test by sending encoded null bytes (%00) in every parameter that reaches a file, command or query.
How to fix it
MITRE's mitigation is to remove null bytes from all incoming strings.
$page = str_replace("\0", '', $_GET['page'] ?? '');
Pair this with an allowlist of valid page names, which is a general good practice, not a record item.
Quick check
Why does a NUL byte cut off a hard-coded extension?
The C layer stops reading at the null byte, so anything the app appended after it, such as .php, is ignored.
