The product does not properly restrict reading from or writing to dynamically-identified variables.
Many languages offer powerful features that allow the programmer to access arbitrary variables that are specified by an input string. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can modify unintended variables that have security implications.

Primary

Implementation

Integrity
Modify Application Data
An attacker could modify sensitive data or program variables.

Integrity
Execute Unauthorized Code or Commands

Other
Integrity
Varies by Context
Alter Execution Logic

Implementation
Input Validation
For any externally-influenced input, check the input against an allowlist of internal program variables that are allowed to be modified.

Implementation
Architecture and Design
Refactoring
Refactor the code so that internal program variables do not need to be dynamically identified.

This code uses the credentials sent in a POST request to login a user.

//Log user in, and set $isAdmin to true if user is an administrator

function login($user,$pass){$query = buildQuery($user,$pass);mysql_query($query);if(getUserRole($user) == "Admin"){$isAdmin = true;}}
$isAdmin = false;extract($_POST);login(mysql_real_escape_string($user),mysql_real_escape_string($pass));

The call to extract() will overwrite the existing values of any variables defined previously, in this case $isAdmin. An attacker can send a POST request with an unexpected third value "isAdmin" equal to "true", thus gaining Admin privileges.

CVE-2006-7135
extract issue enables file inclusion
https://www.cve.org/CVERecord?id=CVE-2006-7135

CVE-2006-7079
Chain: extract used for register_globals compatibility layer, enables path traversal (CWE-22)
https://www.cve.org/CVERecord?id=CVE-2006-7079

CVE-2007-0649
extract() buried in include files makes post-disclosure analysis confusing; original report had seemed incorrect.
https://www.cve.org/CVERecord?id=CVE-2007-0649

CVE-2006-6661
extract() enables static code injection
https://www.cve.org/CVERecord?id=CVE-2006-6661

CVE-2006-2828
import_request_variables() buried in include files makes post-disclosure analysis confusing
https://www.cve.org/CVERecord?id=CVE-2006-2828

CVE-2009-0422
Chain: Dynamic variable evaluation allows resultant remote file inclusion and path traversal.
https://www.cve.org/CVERecord?id=CVE-2009-0422

CVE-2007-2431
Chain: dynamic variable evaluation in PHP program used to modify critical, unexpected $_SERVER variable for resultant XSS.
https://www.cve.org/CVERecord?id=CVE-2007-2431

CVE-2006-4904
Chain: dynamic variable evaluation in PHP program used to conduct remote file inclusion.
https://www.cve.org/CVERecord?id=CVE-2006-4904

CVE-2006-4019
Dynamic variable evaluation in mail program allows reading and modifying attachments and preferences of other users.
https://www.cve.org/CVERecord?id=CVE-2006-4019

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Content Team
MITRE
2013-01-26
2.4
2013-02-21

CWE Content Team
MITRE
2017-01-19
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2020-06-25
updated Potential_Mitigations

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms