Source-derived document; reported behaviour, inference and evidence gaps are identified in the text.

Return to: Hazards, Unknowns, and Backlog — topic detail

Customer query construction

Hazard: Customer query construction

Customer browsing and mailing-label selection construct SQL predicates by concatenating a generated condition into a query containing the customer table and an ordering clause. The reported forms order customer results by last name for browsing and by ZIP code for mailing labels. The implementation of the Construct component, including any escaping or parameterization guarantees, is absent. Consequently, the evidence supports an unresolved SQL-injection or query-validity risk, but does not prove a vulnerability. E0002