Example - 1

This example attempts to write user messages to a message file and allow users to view them.

$name = $_GET["name"];$message = $_GET["message"];$handle = fopen($MessageFile, "a+");fwrite($handle, "<b>$name</b> says '$message'<hr>\n");fclose($handle);echo "Message Saved!<p>\n";
include($MessageFile);$MessageFile = "messages.out";if ($_GET["action"] == "NewMessage") {}else if ($_GET["action"] == "ViewMessages") {}

While the programmer intends for the MessageFile to only include data, an attacker can provide a message such as:

name=h4x0rmessage=%3C?php%20system(%22/bin/ls%20-l%22);?%3E

which will decode to the following:

<?php system("/bin/ls -l");?>

The programmer thought they were just including the contents of a regular data file, but PHP parsed it and executed the code. Now, this code is executed any time people view messages.

Notice that XSS (CWE-79) is also possible in this situation.

Example - 2

edit-config.pl: This CGI script is used to modify settings in a configuration file.

// # code to add a field/key to a file goes here// 
my ($fname, $key, $arg) = @_;

// # code to set key to a particular file goes here// 
my ($fname, $key, $arg) = @_;

// # code to delete key from a particular file goes here// 
my ($fname, $key, $arg) = @_;

// # this is super-efficient code, especially if you have to invoke// 
// # any one of dozens of different functions!// 
my ($fname, $action) = @_;my $key = param('key');my $val = param('val');my $code = "config_file_$action_key(\$fname, \$key, \$val);";eval($code);
handleConfigAction($configfile, param('action'));
print "No action specified!\n";use CGI qw(:standard);sub config_file_add_key {}sub config_file_set_key {}sub config_file_delete_key {}sub handleConfigAction {}$configfile = "/home/cwe/config.txt";print header;if (defined(param('action'))) {}else {}

The script intends to take the 'action' parameter and invoke one of a variety of functions based on the value of that parameter - config_file_add_key(), config_file_set_key(), or config_file_delete_key(). It could set up a conditional to invoke each function separately, but eval() is a powerful way of doing the same thing in fewer lines of code, especially when a large number of functions or variables are involved. Unfortunately, in this case, the attacker can provide other values in the action parameter, such as:

add_key(",","); system("/bin/ls");

This would produce the following string in handleConfigAction():

config_file_add_key(",","); system("/bin/ls");

Any arbitrary Perl code could be added after the attacker has "closed off" the construction of the original function call, in order to prevent parsing errors from causing the malicious eval() to fail before the attacker's payload is activated. This particular manipulation would fail after the system() call, because the "_key(\$fname, \$key, \$val)" portion of the string would cause an error, but this is irrelevant to the attack because the payload has already been activated.

Example - 3

This simple script asks a user to supply a list of numbers as input and adds them together.

sum = sum + numsum = 0numbers = eval(input("Enter a space-separated list of numbers: "))for num in numbers:print(f"Sum of {numbers} = {sum}")def main():main()

The eval() function can take the user-supplied list and convert it into a Python list object, therefore allowing the programmer to use list comprehension methods to work with the data. However, if code is supplied to the eval() function, it will execute that code. For example, a malicious user could supply the following string:

__import__('subprocess').getoutput('rm -r *')

This would delete all the files in the current directory. For this reason, it is not recommended to use eval() with untrusted input.

A way to accomplish this without the use of eval() is to apply an integer conversion on the input within a try/except block. If the user-supplied input is not numeric, this will raise a ValueError. By avoiding eval(), there is no opportunity for the input string to be executed as code.

sum = sum + int(num)for num in numbers:print(f"Sum of {numbers} = {sum}")

print("Error: invalid input")sum = 0numbers = input("Enter a space-separated list of numbers: ").split(" ")try:except ValueError:def main():main()

An alternative option is to use the ast.literal_eval() function from Python's ast module. This function considers only Python literals as valid data types and will not execute any code contained within the user input.