🛡️ Potential SQL Injection in SELECT

Severity: High
Score: 7.5
Accurracy: Confirmed
Language: ADVPL
CVSS v3.1: /AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Potential SQL Injection vulnerability detected due to unsanitized input in SQL queries. Executing SQL queries with unsanitized user input can lead to SQL Injection vulnerabilities. Ensure that user inputs are properly sanitized and use parameterized queries to prevent such issues.

👾 Vulnerable Code

📋 Copy
...
cSql := "SELECT * FROM Cliente WHERE Codigo = '" + cCodigo + "'"
...


For ADVPL language we recommend accessing the official documentation:

🛠️ How to fix

Please check the official documentation: https://tdn.totvs.com/display/tec/Linguagem