This is a follow up to a question I posted on Stack Overflow but you don't need to read that question - I'm recapping the pertinent details here.
I'm testing a PHP application which uses a MySQL database as a data store. I am using parameterized queries exclusively, via an ORM library.
I have discovered that a particular POST request with a payload like this:
will modify the database row where
id = 3. After some investigation, it was determined that the value "3-2" is passed through to the database (via a parameterized query) and selects the row where
id = 3, which is then updated.
Now it seems to me that this is a security flaw: I am able to manipulate the data in my database by POSTing an arbitrary value for the
id parameter. Admittedly, the range of values for which this kind of attack is possible is limited: the ID parameter must be a string prefixed with a number, and that number must correspond to an ID in my database.
So I have two questions:
Is this really a security flaw that I should be worried about?
At what level should this be addressed in my application?
- The MySQL server, perhaps by changing some configuration values?
- The ORM library, perhaps by checking the value of the ID used before attempting to query the database?
- In my code, before I even try to instantiate the model?
Thanks for you help! I'm just starting out learning about security & any input will be helpful!