CWE-473: PHP External Variable Modification
A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
View on MITRETechnical Details
- Structure
- Simple
Applicable To
Security Consequences
Scope
Impact
Mitigation Strategies
Phase
Description
Carefully identify which variables can be controlled or influenced by an external user, and consider adopting a naming convention to emphasize when externally modifiable variables are being used. An application should be reluctant to trust variables that have been initialized outside of its trust boundary. Ensure adequate checking is performed when relying on input from outside a trust boundary. Do not allow your application to run with register_globals enabled. If you implement a register_globals emulator, be extremely careful of variable extraction, dynamic evaluation, and similar issues, since weaknesses in your emulation could allow external variable modification to take place even without register_globals.
Detection Methods
No detection method information available for this CWE.
Code Examples & CVEs
Observed CVE Examples (5)
File upload allows arbitrary file read by setting hidden form variables to match internal variable names.
View DetailsMistakenly trusts $PHP_SELF variable to determine if include script was called by its parent.
View DetailsModify key variable when calling scripts that don't load a library that initializes it.
View DetailsCWE Relationships
Frequently Asked Questions
What is CWE-473: PHP External Variable Modification?+
CWE-473: PHP External Variable Modification is a Common Weakness Enumeration (CWE) entry maintained by MITRE. A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
What are the security consequences of PHP External Variable Modification?+
If exploited, CWE-473 (PHP External Variable Modification) it can compromise Integrity, leading to outcomes such as Modify Application Data.
How do you prevent or mitigate PHP External Variable Modification?+
Recommended mitigations for CWE-473 include: Carefully identify which variables can be controlled or influenced by an external user, and consider adopting a naming convention to emphasize when externally modifiable variables are being used. An application should be reluctant to trust variables that have been initialized outside of its trust boundary. Ensure adequate checking is performed when relying on input from outside a trust boundary. Do not allow your application to run with register_globals enabled. If you implement a register_globals emulator, be extremely careful of variable extraction, dynamic evaluation, and similar issues, since weaknesses in your emulation could allow external variable modification to take place even without register_globals.
Which programming languages are affected by PHP External Variable Modification?+
CWE-473 commonly affects PHP. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of PHP External Variable Modification?+
MITRE documents real CVEs mapped to CWE-473, including CVE-2000-0860, CVE-2001-0854, CVE-2002-0764, CVE-2001-1025 and CVE-2003-0754. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-473 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.