Skip to content
OpenAdvisories

Weakness (CWE)

CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key

Variant Incomplete

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

How to prevent it (3 mitigations)

  1. Implementation

    Modify the query to include a clause that
    performs an authorization check, or otherwise ensure
    that the check is performed before the query is
    executed.

  2. Implementation

    Assume all input is malicious. Use a standard input validation mechanism to validate all input for length, type, syntax, and business rules before accepting the data. Use an "accept known good" validation strategy.

  3. Implementation

    Use a parameterized query AND make sure that the accepted values conform to the business rules. Construct your SQL statement accordingly.

Source: MITRE CWE-566

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-9953

    SQLi in Database Software's Databank Accreditation Software

    Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows SQL Injection. This issue affects Databank Accreditation Software: before 2026/04.

    DATABASE Software Training Consulting Databank Accreditation Software
  • Critical 9.1
    CVE-2014-0808

    EC-CUBE vulnerable to authorization bypass

    Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' informati…

    EC-CUBE S‑cubism EC-CUBE EC-Orange Packagist