...
This rule is a specific instance of IDS00-J. Sanitize untrusted data passed across a trust boundaryPrevent SQL Injection. Any string data that originates from outside the program's trust boundary must be sanitized before being executed as a command on the current platform.
...
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
IDS07-J | High | Probable | Medium | P12 | L1 |
Automated Detection
| Tool | Version | Checker | Description |
|---|---|---|---|
| Coverity | 7.5 | OS_CMD_INJECTION | Implemented |
Related Vulnerabilities
CVE-2010-0886 | |
CVE-2010-1826 | Command injection in |
T-472 | Mac OS X Java Command Injection Flaw in |
...
ENV03-C. Sanitize the environment when invoking external programs | |
| |
ENV03-CPP. Sanitize the environment when invoking external programs | |
| CERT Perl Secure Coding Standard | IDS34-PL. Do not pass untrusted, unsanitized data to a command interpreter |
Injection [RST] | |
CWE-78, Improper neutralization of special elements used in an OS command ("OS command injection") |
...