CWE-566—Authorization Bypass Through User-Controlled SQL Primary Key

名称

Authorization Bypass Through User-Controlled SQL Primary Key

描述

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

When a user can set a primary key to any value, then the user can modify the key to point to unauthorized records. Database access control errors occur when:

常见后果

范围：

Confidentiality, Integrity, Access Control

影响：

Read Application Data, Modify Application Data, Bypass Protection Mechanism

相关 CWE

• CWE-639Authorization Bypass Through User-Controlled KeyHigh