CWE-914, Improper Control of Dynamically-Identified Variables, applies when a product lets input specify which variable is read or written, without restricting the choices. It is mostly an issue in interpreted languages.
How it happens
Many languages can access a variable by name held in a string. That is flexible and saves time. It is also dangerous when an attacker can change variables with security meaning, such as an authorization flag or a file path.
MITRE's observed examples all point at one PHP function, extract(), which imports array keys as variables. Request parameters become local variables with names the attacker picks.
// Vulnerable: every request parameter becomes a variable
$is_admin = false;
extract($_GET);
if ($is_admin) { show_admin_panel(); }
// A request with ?is_admin=1 overwrites the flag
The listed CVEs show the effects: CVE-2006-7135 (details) enabled file inclusion, CVE-2006-6661 enabled static code injection, and CVE-2006-7079 was a chain where extract used as a register_globals compatibility layer enabled path traversal. CVE-2007-0649 noted extract() buried in include files, which made analysis after disclosure confusing.
What an attacker gains
MITRE lists modifying application data or program variables, executing unauthorized code or commands, and altering execution logic, depending on context.
How to find it
The record lists no detection methods. Search for dynamic variable features: extract, variable variables, and similar calls that take names from input. Pay special attention to calls hidden in included files.
How to fix it
From MITRE:
- For any externally influenced input, check it against an allowlist of internal program variables that are allowed to be modified.
- Refactor the code so internal variables do not need to be dynamically identified.
$allowed = ['page', 'sort'];
foreach ($allowed as $key) {
if (isset($_GET[$key])) { $params[$key] = $_GET[$key]; }
}
Quick check
Why is the allowlist better than blocking known bad names?
New variables get added over time. An allowlist stays safe by default, while a blocklist needs updating whenever code changes.
