cve.bz

CWE-88: Improper Neutralization of Argument Delimiters in a Command (Argument Injection), page 11

Filter

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

What the weakness is: CWE-88 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 5
  • CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads Likelihood: High · Severity: High
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-137 Parameter Injection Likelihood: Medium · Severity: Medium
  • CAPEC-174 Flash Parameter Injection Likelihood: High · Severity: Medium
  • CAPEC-460 HTTP Parameter Pollution (HPP) Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-88, as MITRE names them. Credits.

Ask an AI about CWE-88

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-88: Improper Neutralization of Argument Delimiters in a Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/88.html and https://cve.bz/cve/cwe/88?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. –CVE-2006-2055EPSS 15%

    Argument injection vulnerability in Microsoft Outlook 2003 SP1 allows user-assisted remote attackers to modify command line arguments to an invoked mail client via " (double quote) characters in a mailto: scheme handler, as demonstrated by…

  2. –CVE-2006-1865EPSS 3.5%

    Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments when Beagle launches external helper applications while indexing.

  3. –CVE-2005-4699EPSS 1.9%

    Argument injection vulnerability in TellMe 1.2 and earlier allows remote attackers to modify command line arguments for the Whois program and obtain sensitive information via "--" style options in the q_Host parameter.

  4. –CVE-2004-0480EPSS 8.6%

    Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via a notes: URI that uses a UNC network share pathname to provide an alternate notes.ini configuration file to notes.exe.

  5. –CVE-2004-0489EPSS 6.7%

    Argument injection vulnerability in the SSH URI handler for Safari on Mac OS 10.3.3 and earlier allows remote attackers to (1) execute arbitrary code via the ProxyCommand option or (2) conduct port forwarding via the -R option.

  6. –CVE-2004-0473EPSS 2.5%

    Argument injection vulnerability in Opera before 7.50 does not properly filter "-" characters that begin a hostname in a telnet URI, which allows remote attackers to insert options to the resulting command line and overwrite arbitrary file…

  7. –CVE-2004-0411EPSS 7.8%

    The URI handlers in Konqueror for KDE 3.2.2 and earlier do not properly filter "-" characters that begin a hostname in a (1) telnet, (2) rlogin, (3) ssh, or (4) mailto URI, which allows remote attackers to manipulate the options that are p…

  8. –CVE-2003-0907EPSS 22%

    Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list…

  9. –CVE-2004-0121ExploitEPSS 48%

    Argument injection vulnerability in Microsoft Outlook 2002 does not sufficiently filter parameters of mailto: URLs when using them as arguments when calling OUTLOOK.EXE, which allows remote attackers to use script code in the Local Machine…

  10. –CVE-2002-0985EPSS 3.0%

    Argument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to bypass safe mode restrictions and modify command line arguments to the MTA (e.g. sendmail) in the 5th argument to mail(), altering MTA behavi…

  11. 7.3CVE-2001-0667EPSS 15%

    Internet Explorer 6 and earlier, when used with the Telnet client in Services for Unix (SFU) 2.0, allows remote attackers to execute commands by spawning Telnet with a log file option on the command line and writing arbitrary code into an …

  12. –CVE-2001-1246ExploitEPSS 9.7%

    PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.

  13. –CVE-2001-0150ExploitEPSS 18%

    Internet Explorer 5.5 and earlier executes Telnet sessions using command line arguments that are specified by the web site, which could allow remote attackers to execute arbitrary commands if the IE client is using the Telnet client provid…

  14. –CVE-1999-0113ExploitEPSS 17%

    Some implementations of rlogin allow root access if given a -froot parameter.