Weakness (CWE)

CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key

Variant Incomplete

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

How to prevent it (3 mitigations)

Implementation

Modify the query to include a clause that
performs an authorization check, or otherwise ensure
that the check is performed before the query is
executed.
Implementation

Assume all input is malicious. Use a standard input validation mechanism to validate all input for length, type, syntax, and business rules before accepting the data. Use an "accept known good" validation strategy.
Implementation

Use a parameterized query AND make sure that the accepted values conform to the business rules. Construct your SQL statement accordingly.

Source: MITRE CWE-566

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.