CWE-473: PHP External Variable Modification
A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
Last updated
Overview
CWE-473 (PHP External Variable Modification) is a variant-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.
Real-world CVEs
4 recorded CVEs are caused by CWE-473 (PHP External Variable Modification), including 2 in CISA's KEV (Known Exploited Vulnerabilities) catalog. KEVs are shown first. 1 new CWE-473 CVE has been recorded so far in 2026.
- CVE-2023-36845CISA KEV
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
Critical · CVSS 10.0 · EPSS 100th2023-08-17 - CVE-2023-36844CISA KEV
Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables
Medium · CVSS 6.9 · EPSS 100th2023-08-17 - CVE-2026-40285
WeGIA has SQL Injection via Session Variable Override in DespachoControle.php
High · CVSS 8.8 · EPSS 18th2026-04-17 - CVE-2024-27489High · CVSS 7.5 · EPSS 33th2024-07-19
Common consequences
What can happen when CWE-473 is exploited.
Modify Application Data
Affects: Integrity
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Applies to
Languages
How to prevent it
Practical mitigations for CWE-473, grouped by where in the lifecycle they apply.
Carefully identify which variables can be controlled or influenced by an external user, and consider adopting a naming convention to emphasize when externally modifiable variables are being used. An application should be reluctant to trust variables that have been initialized outside of its trust boundary. Ensure adequate checking is performed when relying on input from outside a trust boundary. Do not allow your application to run with register_globals enabled. If you implement a register_globals emulator, be extremely careful of variable extraction, dynamic evaluation, and similar issues, since weaknesses in your emulation could allow external variable modification to take place even without register_globals.
Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2000-0860 — File upload allows arbitrary file read by setting hidden form variables to match internal variable names.
- CVE-2001-0854 — Mistakenly trusts $PHP_SELF variable to determine if include script was called by its parent.
- CVE-2002-0764 — PHP remote file inclusion by modified assumed-immutable variable.
- CVE-2001-1025 — Modify key variable when calling scripts that don't load a library that initializes it.
- CVE-2003-0754 — Authentication bypass by modifying array used for authentication.
Terminology & mappings
Mapped taxonomies
- PLOVER: PHP External Variable Modification
Attack patterns
CAPEC attack patterns that exploit this weakness.
Frequently asked questions
Common questions about CWE-473.
- What is CWE-473?
- A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
- What CVEs are caused by CWE-473?
- 4 recorded CVEs are attributed to CWE-473, including CVE-2023-36845, CVE-2023-36844, CVE-2026-40285. 2 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- How do you prevent CWE-473?
- Carefully identify which variables can be controlled or influenced by an external user, and consider adopting a naming convention to emphasize when externally modifiable variables are being used. An application should be reluctant to trust variables that have been initialized outside of its trust boundary. Ensure adequate checking is performed when relying on input from outside a trust boundary. Do not allow your application to run with register_globals enabled. If you implement a register_globals emulator, be extremely careful of variable extraction, dynamic evaluation, and similar issues, since weaknesses in your emulation could allow external variable modification to take place even without register_globals.
- What are the consequences of CWE-473?
- Exploiting CWE-473 can lead to: Modify Application Data.
- Is CWE-473 actively exploited?
- Yes. 2 CWE-473 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 4 recorded CVEs.
References
- MITRE CWE definition (CWE-473) (opens in a new tab)
- CWE-473 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-473
Get alerted the moment a new CWE-473 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.