CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

• Confidentiality, Integrity, Access Control: Read Application Data, Modify Application Data, Bypass Protection Mechanism — When a user can set a primary key to any value, then the user can modify the key to point to unauthorized records.

• [Implementation] Modify the query to include a clause that performs an authorization check, or otherwise ensure that the check is performed before the query is executed. • [Implementation] Assume all input is malicious. Use a standard input validation mechanism to validate all input for length, type, syntax, and business rules before accepting the data. Use an "accept known good" validation strategy. • [Implementation] Use a parameterized query AND make sure that the accepted values conform to the business rules. Construct your SQL statement accordingly.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)