8. of Denial of Service
An attacker can make a server unavailable or unusable and the problem persists after the attacker goes away (server, authenticated, persistent).
|
Threat |
|
|
|
You are not validating or sanitizing untrusted user input before querying the database. Using SQL injection, an attacker deletes all the users of the system from the database. |
|
CAPEC |
CAPEC-66 – SQL injection |
|
ASVS |
5.3.4 – Ensure you’re using parameterized queries |
|
CWE |
CWE-89 – Improper neutralization of special elements used in an SQL command (SQL injection) |
|
Mitigations |
|
|
|
|
