CWE-77 refers to the improper neutralisation of special elements used in a command. These special elements, when inadequately sanitised, allow attackers to inject malicious commands that the system interprets and executes. This vulnerability commonly appears in applications that dynamically construct system commands based on user inputs.
Improper input validation occurs when a software application fails to verify that input received is within the expected range, format, type, or value before processing. This weakness paves the way for a variety of security exploits, including injection attacks, buffer overflows, and data manipulation, which can compromise application functionality and user data.
CWE-94, or Code Injection, occurs when a software application improperly controls the input used in generating code. This vulnerability allows attackers to inject malicious code, which the application subsequently compiles or interprets. The injected code can execute unintended commands, compromise data integrity, and even provide attackers with full control over the system.
At its core, CWE-434 occurs when an application fails to restrict file uploads to safe and intended file types. This weakness allows attackers to upload malicious files, potentially executing arbitrary code, accessing sensitive data, or gaining unauthorised access to the system.
Missing Authorisation, identified by CWE-862, refers to a software weakness where an application fails to verify if a user is permitted to access specific resources or perform certain actions. While authentication establishes identity, authorisation ensures that the authenticated user has the necessary permissions. When authorisation is missing, attackers can exploit this oversight to access sensitive data, perform unauthorised transactions, or disrupt services.