A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.

Primary

Resultant

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Integrity
Modify Application Data

Requirements
Implementation
Carefully identify which variables can be controlled or influenced by an external user, and consider adopting a naming convention to emphasize when externally modifiable variables are being used. An application should be reluctant to trust variables that have been initialized outside of its trust boundary. Ensure adequate checking is performed when relying on input from outside a trust boundary. Do not allow your application to run with register_globals enabled. If you implement a register_globals emulator, be extremely careful of variable extraction, dynamic evaluation, and similar issues, since weaknesses in your emulation could allow external variable modification to take place even without register_globals.

CVE-2000-0860
File upload allows arbitrary file read by setting hidden form variables to match internal variable names.
https://www.cve.org/CVERecord?id=CVE-2000-0860

CVE-2001-0854
Mistakenly trusts $PHP_SELF variable to determine if include script was called by its parent.
https://www.cve.org/CVERecord?id=CVE-2001-0854

CVE-2002-0764
PHP remote file inclusion by modified assumed-immutable variable.
https://www.cve.org/CVERecord?id=CVE-2002-0764

CVE-2001-1025
Modify key variable when calling scripts that don't load a library that initializes it.
https://www.cve.org/CVERecord?id=CVE-2001-1025

CVE-2003-0754
Authentication bypass by modifying array used for authentication.
https://www.cve.org/CVERecord?id=CVE-2003-0754

PHP External Variable Modification

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

This is a language-specific instance of Modification of Assumed-Immutable Data (MAID). This can be resultant from direct request (alternate path) issues. It can be primary to weaknesses such as PHP file inclusion, SQL injection, XSS, authentication bypass, and others.

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Relationships, Other_Notes, Taxonomy_Mappings

CWE Content Team
MITRE
2009-12-28
updated Other_Notes, Relationship_Notes

CWE Content Team
MITRE
2010-02-16
updated Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Weakness_Ordinalities