209
Example Language: (Attack)
SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY=''; exec master..xp_cmdshell 'dir' --' ORDER BY
PRICE
Now, this query can be broken down into:
1. a first SQL query: SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='';
2. a second SQL query, which executes the dir command in the shell: exec master..xp_cmdshell
'dir'
3. an MS SQL comment: --' ORDER BY PRICE
As can be seen, the malicious input changes the semantics of the query into a query, a shell
command execution and a comment.
Example 5:
This code intends to print a message summary given the message ID.
Example Language: PHP (Bad)
$id = $_COOKIE["mid"];
mysql_query("SELECT MessageID, Subject FROM messages WHERE MessageID = '$id'");
The programmer may have skipped any input validation on $id under the assumption that attackers
cannot modify the cookie. However, this is easy to do with custom client code or even in the web
browser.
While $id is wrapped in single quotes in the call to mysql_query(), an attacker could simply change
the incoming mid cookie to:
Example Language: (Attack)
1432' or '1' = '1
This would produce the resulting query:
Example Language: (Result)
SELECT MessageID, Subject FROM messages WHERE MessageID = '1432' or '1' = '1'
Not only will this retrieve message number 1432, it will retrieve all other messages.
In this case, the programmer could apply a simple modification to the code to eliminate the SQL
injection:
Example Language: PHP (Good)
$id = intval($_COOKIE["mid"]);
mysql_query("SELECT MessageID, Subject FROM messages WHERE MessageID = '$id'");
However, if this code is intended to support multiple users with different message boxes, the code
might also need an access control check (CWE-285) to ensure that the application user has the
permission to see that message.
Example 6:
This example attempts to take a last name provided by a user and enter it into a database.
Example Language: Perl (Bad)
$userKey = getUserID();
$name = getUserInput();
CWE Version 4.14
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89: Improper Neutralization of Special
Elements used in an SQL Command ('SQL Injection') 210
# ensure only letters, hyphens and apostrophe are allowed
$name = allowList($name, "^a-zA-z'-$");
$query = "INSERT INTO last_names VALUES('$userKey', '$name')";
While the programmer applies an allowlist to the user input, it has shortcomings. First of all,
the user is still allowed to provide hyphens, which are used as comment structures in SQL. If a
user specifies "--" then the remainder of the statement will be treated as a comment, which may
bypass security logic. Furthermore, the allowlist permits the apostrophe, which is also a data /
command separator in SQL. If a user supplies a name with an apostrophe, they may be able to
alter the structure of the whole statement and even change control flow of the program, possibly
accessing or modifying confidential information. In this situation, both the hyphen and apostrophe
are legitimate characters for a last name and permitting them is required. Instead, a programmer
may want to use a prepared statement or apply an encoding routine to the input to prevent any
data / directive misinterpretations.
Observed Examples
Reference Description
CVE-2023-32530 SQL injection in security product dashboard using crafted certificate fields
https://www.cve.org/CVERecord?id=CVE-2023-32530
CVE-2021-42258 SQL injection in time and billing software, as exploited in the wild per CISA
KEV.
https://www.cve.org/CVERecord?id=CVE-2021-42258
CVE-2021-27101 SQL injection in file-transfer system via a crafted Host header, as exploited in
the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-27101
CVE-2020-12271 SQL injection in firewall product's admin interface or user portal, as exploited in
the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-12271
CVE-2019-3792 An automation system written in Go contains an API that is vulnerable to SQL
injection allowing the attacker to read privileged data.
https://www.cve.org/CVERecord?id=CVE-2019-3792
CVE-2004-0366 chain: SQL injection in library intended for database authentication allows SQL
injection and authentication bypass.
https://www.cve.org/CVERecord?id=CVE-2004-0366
CVE-2008-2790 SQL injection through an ID that was supposed to be numeric.
https://www.cve.org/CVERecord?id=CVE-2008-2790
CVE-2008-2223 SQL injection through an ID that was supposed to be numeric.
https://www.cve.org/CVERecord?id=CVE-2008-2223
CVE-2007-6602 SQL injection via user name.
https://www.cve.org/CVERecord?id=CVE-2007-6602
CVE-2008-5817 SQL injection via user name or password fields.
https://www.cve.org/CVERecord?id=CVE-2008-5817
CVE-2003-0377 SQL injection in security product, using a crafted group name.
https://www.cve.org/CVERecord?id=CVE-2003-0377
CVE-2008-2380 SQL injection in authentication library.
https://www.cve.org/CVERecord?id=CVE-2008-2380
CVE-2017-11508 SQL injection in vulnerability management and reporting tool, using a crafted
password.
https://www.cve.org/CVERecord?id=CVE-2017-11508
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89: Improper Neutralization of Special
Elements used in an SQL Command ('SQL Injection')