Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
| OWASP | A01:2017 - Injection |
| Confidence Level | Medium |
| Impact Level | Medium |
| Likelihood Level | High |
Description#
Your code builds SQL queries using values taken directly from the event object, which may contain user input. Without proper sanitization or parameterization, this allows attackers to inject malicious SQL code.
Impact#
If exploited, an attacker could manipulate database queries to access, modify, or delete data they shouldn’t have permission to, potentially exposing sensitive information or compromising the integrity of your application.