Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
| OWASP | A01:2017 - Injection |
| Confidence Level | Low |
| Impact Level | High |
| Likelihood Level | Low |
Description#
Building SQL queries in psycopg2 by concatenating variables directly into the query string can allow user input to change the structure of the SQL command. This exposes your code to SQL injection attacks when user data is not properly handled.
Impact#
If exploited, attackers could manipulate database queries to read, modify, or delete data, bypass authentication, or gain unauthorized access to sensitive information. This could result in data breaches, data loss, or full compromise of the application’s database.