Weakness (CWE)
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key
The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
How to prevent it (3 mitigations)
-
Implementation
Modify the query to include a clause that
performs an authorization check, or otherwise ensure
that the check is performed before the query is
executed. -
Implementation
Assume all input is malicious. Use a standard input validation mechanism to validate all input for length, type, syntax, and business rules before accepting the data. Use an "accept known good" validation strategy.
-
Implementation
Use a parameterized query AND make sure that the accepted values conform to the business rules. Construct your SQL statement accordingly.
Source: MITRE CWE-566
10 results · Feed
-
High 8.1
MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail
MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or …
-
High 8.8
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowi…
-
Medium 6.5
OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. …
-
Critical 9.8
SQLi in Database Software's Databank Accreditation Software
Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows SQL Injection. This issue affects Databank Accreditation Software: before 2026/04.
-
High 7.1
GraphQL IDOR allows authenticated user to delete workspace content of other users
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as dashboards and invest…
-
Low 3.8
Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool
An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel - to gain escalated privileges in the context of the SQL query tool.
-
Low 2.7
Zulip allows the deletion of Custom profile fields by administrators of a different organization
Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user…
-
Low 2.7
Zulip allows the deletion of organization by administrators of a different organization
Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, a…
-
Low 2.7
SQL Injection in Harbor scan log API
SQL-Injection in Harbor allows priviledge users to leak the task IDs
-
Critical 9.1
EC-CUBE vulnerable to authorization bypass
Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' informati…