89
SEI CERT Oracle Coding
Standard for Java
IDS00-J Exact Prevent SQL injection
CWE Version 4.14
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-90: Improper Neutralization of Special
Elements used in an LDAP Query ('LDAP Injection') 212
Related Attack Patterns
CAPEC-ID Attack Pattern Name
7 Blind SQL Injection
66 SQL Injection
108 Command Line Execution through SQL Injection
109 Object Relational Mapping Injection
110 SQL Injection through SOAP Parameter Tampering
470 Expanding Control over the Operating System from the Database
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-867]OWASP. "SQL Injection Prevention Cheat Sheet". < http://www.owasp.org/index.php/
SQL_Injection_Prevention_Cheat_Sheet >.
[REF-868]Steven Friedl. "SQL Injection Attacks by Example". 2007 October 0. < http://
www.unixwiz.net/techtips/sql-injection.html >.
[REF-869]Ferruh Mavituna. "SQL Injection Cheat Sheet". 2007 March 5. < https://web.archive.org/
web/20080126180244/http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/ >.2023-04-07.
[REF-870]David Litchfield, Chris Anley, John Heasman and Bill Grindlay. "The Database Hacker's
Handbook: Defending Database Servers". 2005 July 4. Wiley.
[REF-871]David Litchfield. "The Oracle Hacker's Handbook: Hacking and Defending Oracle". 2007
January 0. Wiley.
[REF-872]Microsoft. "SQL Injection". 2008 December. < https://learn.microsoft.com/en-us/previousversions/
sql/sql-server-2008-r2/ms161953(v=sql.105)?redirectedfrom=MSDN >.2023-04-07.
[REF-873]Microsoft Security Vulnerability Research & Defense. "SQL Injection Attack". < https://
msrc.microsoft.com/blog/2008/05/sql-injection-attack/ >.2023-04-07.
[REF-874]Michael Howard. "Giving SQL Injection the Respect it Deserves". 2008 May 5. < https://
learn.microsoft.com/en-us/archive/blogs/michael_howard/giving-sql-injection-the-respect-itdeserves
>.2023-04-07.
[REF-875]Frank Kim. "Top 25 Series - Rank 2 - SQL Injection". 2010 March 1. SANS Software
Security Institute. < https://www.sans.org/blog/top-25-series-rank-2-sql-injection/ >.2023-04-07.
[REF-76]Sean Barnum and Michael Gegick. "Least Privilege". 2005 September 4. < https://
web.archive.org/web/20211209014121/https://www.cisa.gov/uscert/bsi/articles/knowledge/
principles/least-privilege >.2023-04-07.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
[REF-962]Object Management Group (OMG). "Automated Source Code Security Measure
(ASCSM)". 2016 January. < http://www.omg.org/spec/ASCSM/1.0/ >.
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query
('LDAP Injection')
Weakness ID : 90
CWE Version 4.14
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-90: Improper Neutralization of Special
Elements used in an LDAP Query ('LDAP Injection')