137
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1019 Validate Inputs 2433
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
Nature Type ID Name Page
ParentOf 564 SQL Injection: Hibernate 1282
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 137 Data Neutralization Issues 2311
Relevant to the view "Weaknesses in OWASP Top Ten (2013)" (CWE-928)
Nature Type ID Name Page
ParentOf 564 SQL Injection: Hibernate 1282
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Database Server (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Since SQL databases generally hold sensitive data, loss
of confidentiality is a frequent problem with SQL injection
vulnerabilities.
Access Control Bypass Protection Mechanism
If poor SQL commands are used to check user names and
passwords, it may be possible to connect to a system as
another user with no previous knowledge of the password.
Access Control Bypass Protection Mechanism
If authorization information is held in a SQL database, it
may be possible to change this information through the
successful exploitation of a SQL injection vulnerability.
Integrity Modify Application Data
Just as it may be possible to read sensitive information,
it is also possible to make changes or even delete this
information with a SQL injection attack.
Detection Methods
CWE Version 4.14
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89: Improper Neutralization of Special
Elements used in an SQL Command ('SQL Injection')