Example - 1

This function runs an arbitrary SQL query on a given database, returning the result of the query.

// //Use a prepared statement to avoid CWE-89// 
mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName);$preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name');$preparedStatement->execute(array(':name' => $name));return $preparedStatement->fetchAll();
// /.../// 
function runEmployeeQuery($dbName, $name){}$employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);

While this code is careful to avoid SQL Injection, the function does not confirm the user sending the query is authorized to do so. An attacker may be able to obtain sensitive employee information from the database.

Example - 2

The following program could be part of a bulletin board system that allows users to send private messages to each other. This program intends to authenticate the user before deciding whether a private message should be displayed. Assume that LookupMessageObject() ensures that the $id argument is numeric, constructs a filename based on that id, and reads the message details from that file. Also assume that the program stores all private messages for all users in the same directory.

my($id) = @_;my $Message = LookupMessageObject($id);print "From: " . encodeHTML($Message->{from}) . "<br>\n";print "Subject: " . encodeHTML($Message->{subject}) . "\n";print "<hr>\n";print "Body: " . encodeHTML($Message->{body}) . "\n";
// # For purposes of this example, assume that CWE-309 and// 
// # CWE-523 do not apply.// 
ExitError("invalid username or password");
sub DisplayPrivateMessage {}my $q = new CGI;if (! AuthenticateUser($q->param('username'), $q->param('password'))) {}my $id = $q->param('id');DisplayPrivateMessage($id);

While the program properly exits if authentication fails, it does not ensure that the message is addressed to the user. As a result, an authenticated attacker could provide any arbitrary identifier and read private messages that were intended for other users.

One way to avoid this problem would be to ensure that the "to" field in the message object matches the username of the authenticated user.