Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

Opis

The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.

Skutki

• Confidentiality, Integrity, Availability

  Execute Unauthorized Code or Commands

Słabość nadrzędna

• CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Kiedy powstaje

• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific, Web Based, Web Server

Uwagi

This can be resultant from XSS/HTML injection because the same special characters can be involved. However, this is server-side code execution, not client-side.