Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Property	Value
Language
Severity
CWE	CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
OWASP	A01:2017 - Injection
Confidence Level	Medium
Impact Level	Medium
Likelihood Level	Medium

Description

Building Doctrine ORM queries by concatenating variables directly into query strings can allow attackers to inject malicious SQL if those variables are user-controlled. This occurs when user input is not properly sanitized or parameterized in QueryBuilder methods.

Impact

If exploited, an attacker could manipulate database queries to steal, modify, or delete sensitive data, bypass authentication, or damage the integrity of the application. This can lead to data breaches, loss of data, and severe security incidents affecting users and the organization.