Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')

Properties

id: d3f:CWE-652

name
Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
definition
The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
json

Neighbors

CWE-652 has no direct neighbors in this release.

Inferred Relationships

This page is experimental and may change significantly in future releases.

Related Countermeasure Techniques

No related defensive techniques in this release.

Related Weaknesses

Related Offensive Techniques

No related offensive techniques in this release.