CME-1305

SQL Injection Prevention (Parameterized Queries)

Harden Application Unquantified evidence Preventive

Description

Application uses parameterized queries or prepared statements at every database boundary, including direct driver calls, ORM query APIs, stored procedure invocations, and legacy data-access code. Untrusted values are passed only through binding APIs and are never concatenated, interpolated, or formatted into SQL text. SQL elements that drivers cannot bind, including table names, column names, sort directions, keywords, and query fragments, are selected through fixed mappings or strict allowlists. Raw-query and literal-expression escape hatches are prohibited or independently reviewed. This separation of SQL structure from data prevents attackers from injecting statements that read, modify, or delete database contents. Database least privilege in CME-920 limits residual impact, while WAF filtering in CME-904 provides probabilistic defense in depth.

CVSS Vector Impacts

Metric	Transition	Rationale
Confidentiality (C)	H → L	When every database boundary binds untrusted values and strictly maps non-bindable SQL elements, attacker input cannot alter query structure to perform UNION, error-based, stacked, or blind extraction. Low confidentiality impact remains possible through data returned by the application's intended query behavior. This attenuation requires complete coverage of direct queries, ORM escape hatches, stored procedures, and legacy data-access paths.
Integrity (I)	H → L	When every database boundary binds untrusted values and strictly maps non-bindable SQL elements, attacker input cannot inject UPDATE, DELETE, DDL, or stacked statements. Low integrity impact remains possible through modifications permitted by the application's intended operations. This attenuation requires complete coverage of direct queries, ORM escape hatches, stored procedures, and legacy data-access paths.

CWE Relationships

CWE-89

Verification

Use language- and framework-specific static analysis to inventory every database boundary and fail on SQL built through concatenation, interpolation, formatting, raw-query APIs, literal-expression APIs, or dynamically constructed stored procedures. Review every non-bindable identifier or fragment for a fixed mapping or strict allowlist. Pair source analysis with application-specific dynamic tests that exercise representative read and write sinks using boolean, UNION, stacked-query, error-based, time-based, encoded, and second-order payloads. The audit and test commands must cover all production data-access components and emit the exact PASS strings below; set each environment variable to the project's corresponding audit or test command.

$ test -n "$CME_SQL_SOURCE_AUDIT_COMMAND" || { echo 'ERROR: set CME_SQL_SOURCE_AUDIT_COMMAND'; exit 2; }; output=$(sh -c "$CME_SQL_SOURCE_AUDIT_COMMAND") && test "$output" = 'PASS: all database boundaries use parameter binding or strict mappings' && printf '%s\n' "$output"
# Expected: PASS: all database boundaries use parameter binding or strict mappings

Platform: any

$ test -n "$CME_SQLI_READ_TEST_COMMAND" || { echo 'ERROR: set CME_SQLI_READ_TEST_COMMAND'; exit 2; }; output=$(sh -c "$CME_SQLI_READ_TEST_COMMAND") && test "$output" = 'PASS: SQL injection read payloads cannot alter query structure' && printf '%s\n' "$output"
# Expected: PASS: SQL injection read payloads cannot alter query structure

Platform: any

$ test -n "$CME_SQLI_WRITE_TEST_COMMAND" || { echo 'ERROR: set CME_SQLI_WRITE_TEST_COMMAND'; exit 2; }; output=$(sh -c "$CME_SQLI_WRITE_TEST_COMMAND") && test "$output" = 'PASS: SQL injection write payloads cannot modify database state' && printf '%s\n' "$output"
# Expected: PASS: SQL injection write payloads cannot modify database state

Platform: any