Is it a security concern if MySQL manipulates parameter types?

Question

This is a follow up to a question I posted on Stack Overflow but you don't need to read that question - I'm recapping the pertinent details here.

I'm testing a PHP application which uses a MySQL database as a data store. I am using parameterized queries exclusively, via an ORM library.

I have discovered that a particular POST request with a payload like this:

id=3-2&value=whatever

will modify the database row where id = 3. After some investigation, it was determined that the value "3-2" is passed through to the database (via a parameterized query) and selects the row where id = 3, which is then updated.

Now it seems to me that this is a security flaw: I am able to manipulate the data in my database by POSTing an arbitrary value for the id parameter. Admittedly, the range of values for which this kind of attack is possible is limited: the ID parameter must be a string prefixed with a number, and that number must correspond to an ID in my database.

So I have two questions:

1. Is this really a security flaw that I should be worried about?

2. At what level should this be addressed in my application?

   1. The MySQL server, perhaps by changing some configuration values?
   2. The ORM library, perhaps by checking the value of the ID used before attempting to query the database?
   3. In my code, before I even try to instantiate the model?

Thanks for you help! I'm just starting out learning about security & any input will be helpful!

Answer 1

1. This allows for (potentially malicious) actions that are contrary to the intended use of the application, so yes it is a security flaw that you should be worried about. Just because you have found limited use cases / attack vectors does not mean that others don't exist.
2. Ideally you should take a "defense in depth" approach whereby you mitigate the concern in as many levels as is practicable. As mentioned above you have only discovered a single attack vector, and mitigation at all levels requires that any related vectors will have to bypass all mitigations rather than a single-layer one. That being said; it may not be appropriate to modify the ORM library as it is not necessarily a generalisable issue.