Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
| OWASP | A01:2017 - Injection |
| Confidence Level | Medium |
| Impact Level | Medium |
| Likelihood Level | Medium |
Description#
Building Doctrine ORM queries by concatenating variables directly into query strings can allow attackers to inject malicious SQL if those variables are user-controlled. This occurs when user input is not properly sanitized or parameterized in QueryBuilder methods.
Impact#
If exploited, an attacker could manipulate database queries to steal, modify, or delete sensitive data, bypass authentication, or damage the integrity of the application. This can lead to data breaches, loss of data, and severe security incidents affecting users and the organization.