1286
cookies. As a result, the program might skip basic input validation to enable cross-site scripting,
SQL injection, price tampering, and other attacks..
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
Software Fault Patterns SFP29 Faulty endpoint authentication
Related Attack Patterns
CAPEC-ID Attack Pattern Name
31 Accessing/Intercepting/Modifying HTTP Cookies
39 Manipulating Opaque Client-based Data Tokens
226 Session Credential Falsification through Manipulation
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key
Weakness ID : 566
Structure : Simple
Abstraction : Variant
Description
The product uses a database table that includes records that should not be accessible to an actor,
but it executes a SQL statement with a primary key that can be controlled by that actor.
Extended Description
When a user can set a primary key to any value, then the user can modify the key to point to
unauthorized records.
Database access control errors occur when:
• Data enters a program from an untrusted source.
• The data is used to specify the value of a primary key in a SQL query.
• The untrusted source does not have the permissions to be able to access all rows in the
associated table.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 639 Authorization Bypass Through User-Controlled Key 1406
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1011 Authorize Actors 2425
Applicable Platforms
Technology : Database Server (Prevalence = Often)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Read Application Data
Modify Application Data
CWE Version 4.14
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key