Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
| OWASP | A01:2017 - Injection |
| Confidence Level | Low |
| Impact Level | High |
| Likelihood Level | Low |
Description#
Extending Django’s expression or SQL-related classes can introduce SQL injection risks if user input is not carefully handled or sanitized. Custom expressions may allow unsafe data to be incorporated directly into SQL queries.
Impact#
If exploited, attackers could inject malicious SQL commands through unsanitized input, leading to unauthorized data access, data leaks, or manipulation of the database. This can result in exposure of sensitive information or compromise of the entire application.