Finding #35

Critical

Open

SQL Injection in user search query

User-controlled input is concatenated directly into a SQL query string without parameterization, enabling SQL injection attacks.

CWE

CWE-89

CVE

N/A

OWASP

A03:2021-Injection

CVSS Score

9.8

Source

SAST

Category

SQL Injection

Exploitability

Exploitable

Detected

2026-05-27 19:02

Code Location

src/api/users.py:47

cursor.execute(f"SELECT * FROM users WHERE name = '{user_input}'")

AI Explanation

This SQL injection vulnerability allows an attacker to execute arbitrary SQL commands by manipulating the search parameter. The user input flows directly into the query without sanitization or parameterized queries.

Remediation Suggestion

Replace string concatenation with parameterized queries. Use @parameter syntax for SQL Server or %s with parameter tuple for Python.

Best Fix Location: src/api/users.py:47

Change Status