Property
Language
Severity
CWE	CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
OWASP	A01:2017 - Injection
Confidence Level	Medium
Impact Level	High
Likelihood Level	Medium

Description

Detected SQL statement that is tainted by event object. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized statements like so: Example.find_by_sql ["SELECT title FROM posts WHERE author = ? AND created > ?", author_id, start_date]

Property
Language
Severity
CWE	CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
OWASP	A01:2017 - Injection
Confidence Level	Medium
Impact Level	High
Likelihood Level	Medium

Description

User input is being directly inserted into SQL queries by building query strings manually. This practice makes the code vulnerable to SQL injection attacks because untrusted data can alter the structure of the SQL command.

Impact

If exploited, an attacker could steal, modify, or delete data in your database, gain unauthorized access to sensitive information, or potentially compromise the entire application. This can lead to data breaches, data loss, and regulatory or reputational damage.

Property
Language
Severity
CWE	CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
OWASP	A01:2017 - Injection
Confidence Level	Medium
Impact Level	High
Likelihood Level	Medium

Description

User input from the ’event’ object is being directly included in SQL queries without proper sanitization. This allows attackers to inject malicious SQL commands into your database operations.

Impact

If exploited, attackers could manipulate your database—viewing, modifying, or deleting sensitive data, bypassing authentication, or causing data loss. This can lead to data breaches, loss of integrity, and serious damage to your application’s security and reputation.

Property
Language
Severity
CWE	CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
OWASP	A01:2017 - Injection
Confidence Level	Medium
Impact Level	High
Likelihood Level	Medium

Description

User input from the event object is being used directly in SQL queries without proper sanitization. This allows attackers to inject malicious SQL code by manipulating the input.

Impact

If exploited, attackers could access, modify, or delete sensitive database data, potentially exposing user information or compromising application integrity. This could lead to data breaches, loss of trust, and significant legal or financial repercussions.

Property
Language
Severity
CWE	CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
OWASP	A01:2017 - Injection
Confidence Level	Medium
Impact Level	High
Likelihood Level	Medium

Description

User input from the event object is being used directly to build SQL queries without proper sanitization or parameterization. This makes the code vulnerable to SQL injection attacks.

Impact

If exploited, an attacker could manipulate the database by injecting malicious SQL, leading to unauthorized data access, data loss, or corruption. This could compromise sensitive information and potentially give attackers control over your application’s data.

Property
Language
Severity
CWE	CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
OWASP	A01:2017 - Injection
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	High

Description

User input from parameters or cookies is being directly concatenated into SQL queries using the pg gem in Ruby. This allows attackers to inject malicious SQL code if the input is not properly sanitized. Use parameterized queries to prevent this risk.

Property
Language
Severity
CWE	CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
OWASP	A01:2017 - Injection
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	Medium

Description

User input from cookies, parameters, or request environment is being used directly to build SQL queries without proper sanitization. This allows attackers to inject malicious SQL code by manipulating input values.

Impact

If exploited, attackers could access, modify, or delete database data, bypass authentication, or execute administrative operations. This can lead to data breaches, loss of data integrity, and severe security incidents affecting users and the organization.

Property
Language
Severity
CWE	CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
OWASP	A01:2017 - Injection
Confidence Level	Medium
Impact Level	High
Likelihood Level	Medium

Description

User input is being directly used to build SQL queries, which makes the code vulnerable to SQL injection attacks. Instead of manually creating query strings with input, use parameterized queries or an ORM like ActiveRecord.

Impact

If exploited, an attacker could manipulate queries to read, modify, or delete database records, potentially exposing sensitive data or compromising the entire application. This can lead to data breaches, data loss, or unauthorized access.

Property
Language
Severity
CWE	CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Medium

Description

The code builds SQL queries by directly inserting dynamic values into the query string instead of using parameterized queries. This practice can allow untrusted input to alter the intended SQL command, making the code vulnerable to SQL injection.

Impact

If exploited, an attacker could bypass authentication, access or modify sensitive local data, or change app behavior by injecting malicious SQL code. This could compromise user data, app integrity, or expose private information stored on the device.

Property
Language
Severity
CWE	CWE-155: Improper Neutralization of Wildcards or Matching Symbols
OWASP	A01:2017 - Injection
Confidence Level	Low
Impact Level	Low
Likelihood Level	Low

Description

Using shell commands like tar, chmod, chown, or rsync with wildcard characters (e.g., ‘*’) inside Python’s os.system or subprocess calls can unintentionally allow shell expansion on unexpected files. This may cause commands to act on files with malicious names or trigger unexpected behaviors.