名称: Improper Neutralization of Special Elements in Data Query Logic

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

基本信息

引入方式

Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.

适用平台

编程语言

类： Not Language-Specific (Undetermined)

常见后果

影响范围	影响	可能性
Confidentiality Integrity Availability Access Control	Bypass Protection Mechanism, Read Application Data, Modify Application Data, Varies by Context

观察示例

参考资料	描述
CVE-2024-50672	NoSQL injection in product for building eLearning courses allows password resets using a query processed by the Mongoose find function
CVE-2021-20736	NoSQL injection in team collaboration product
CVE-2020-35666	NoSQL injection in a PaaS platform using a MongoDB operator
CVE-2014-2503	Injection using Documentum Query Language (DQL)
CVE-2014-2508	Injection using Documentum Query Language (DQL)

检测方法

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
有效性 : High

漏洞映射说明

依据 : This CWE entry is a Class and might have Base-level children that would be more appropriate
备注 : Examine children of this entry to see if there is a better fit

备注

It could be argued that data query languages are effectively a command language - albeit with a limited set of commands - and thus any query-language injection issue could be treated as a child of CWE-74. However, CWE-943 is intended to better organize query-oriented issues to separate them from fully-functioning programming languages, and also to provide a more precise identifier for the many query languages that do not have their own CWE identifier.

参考资料

REF-1454

NoSQL injection
PortSwigger.
https://portswigger.net/web-security/nosql-injection

REF-1455

A Pentester's Guide to NoSQL Injection
The SecOps Group.
https://secops.group/a-pentesters-guide-to-nosql-injection/

提交记录

名称	组织	日期	发布日期	Version
CWE Content Team	MITRE	2014-06-19 +00:00	2014-06-23 +00:00	2.7

修改记录

名称	组织	日期	备注
CWE Content Team	MITRE	2015-12-07 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Modes_of_Introduction, Observed_Examples, Relationships
CWE Content Team	MITRE	2018-03-27 +00:00	updated Relationships
CWE Content Team	MITRE	2019-06-20 +00:00	updated Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2021-03-15 +00:00	updated Maintenance_Notes
CWE Content Team	MITRE	2022-04-28 +00:00	updated Related_Attack_Patterns
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Detection_Factors, Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2024-02-29 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2025-04-03 +00:00	updated Alternate_Terms, Observed_Examples, References
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description, Dimensions, Technical_Nuance

CWE-943 详情

CWE-943