CWE-943: Improper Neutralization of Special Elements in Data Query Logic, page 4
Filter
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
What the weakness is: CWE-943 at MITRE. All weaknesses
Related attack patterns (CAPEC): 1
- CAPEC-676 NoSQL Injection Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-943, as MITRE names them. Credits.
Ask an AI about CWE-943
Show the prompt
Explain CWE-943: Improper Neutralization of Special Elements in Data Query Logic and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/943.html and https://cve.bz/cve/cwe/943?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.5CVE-2018-19952EPSS 1.3%
If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
- 8.1CVE-2020-5257EPSS 0.9%
In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were abl…
- 8.8CVE-2018-7829EPSS 1.7%
An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which allows an attacker to execute arbitrary system commands.
- 8.8CVE-2017-12904EPSS 6.4%
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell co…