CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

Read Time:28 Second

Description

The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Modes of Introduction:

– Implementation

Likelihood of Exploit:

Related Weaknesses

CWE-74

Consequences

Confidentiality, Integrity, Availability, Access Control: Bypass Protection Mechanism, Read Application Data, Modify Application Data, Varies by Context

Potential Mitigations

CVE References

CVE-2014-2503
- Injection using Documentum Query Language (DQL)

CVE-2014-2508
- Injection using Documentum Query Language (DQL)

InCVE-2014-2503, CWE- 943, Improper Neutralization of Special Elements in Data Query Logic

The Most Dangerous Vulnerabilities in Apache Tomcat and How to Protect Against Them

Apache Tomcat is an open-source web server and servlet container that is widely used in enterprise environments to run Java...

rocco

February 19, 2023February 19, 2023

ZDI-CAN-18333: A Critical Zero-Day Vulnerability in Microsoft Windows

Zero-day vulnerabilities are a serious threat to cybersecurity, as they can be exploited by malicious actors to gain unauthorized access...

rocco

February 19, 2023February 19, 2023

CWE-669 – Incorrect Resource Transfer Between Spheres

Description The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere,...

rocco

May 26, 2022