1283
Follow the principle of least privilege when creating user accounts to a SQL database. Users
should only have the minimum privileges necessary to use their account. If the requirements of
the system indicate that a user can read and modify their own data, then limit their privileges so
they cannot read/write others' data.
Phase: Architecture and Design
For any security checks that are performed on the client side, ensure that these checks are
duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side
checks by modifying values after the checks have been performed, or by changing the client to
remove the client-side checks entirely. Then, these modified values would be submitted to the
server.
Phase: Implementation
Implement SQL strings using prepared statements that bind variables. Prepared statements that
do not bind variables can be vulnerable to attack.
Phase: Implementation
Use vigorous allowlist style checking on any user input that may be used in a SQL command.
Rather than escape meta-characters, it is safest to disallow them entirely. Reason: Later use of
data that have been entered in the database may neglect to escape meta-characters before use.
Narrowly define the set of safe characters based on the expected value of the parameter in the
request.
Demonstrative Examples
Example 1:
The following code excerpt uses Hibernate's HQL syntax to build a dynamic query that's vulnerable
to SQL injection.
Example Language: Java (Bad)
String street = getStreetFromUser();
Query query = session.createQuery("from Address a where a.street='" + street + "'");
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1027 OWASP Top Ten 2017 Category A1 - Injection 1026 2435
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP24 Tainted input to command
Related Attack Patterns
CAPEC-ID Attack Pattern Name
109 Object Relational Mapping Injection
CWE-565: Reliance on Cookies without Validation and Integrity Checking
Weakness ID : 565
CWE Version 4.14
CWE-565: Reliance on Cookies without Validation and Integrity Checking
CWE-565: Reliance on Cookies without Validation and Integrity Checking