V-276230
Microsoft Azure SQL Managed Instance Security Technical Implementation Guide
Title
Azure SQL Managed Instance and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.
Description
<VulnDiscussion>With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection. It takes advantage of the dynamic execution capabilities of various programming languages, including dialects of SQL. In such cases, the attacker deduces the manner in which SQL statements are being processed, either from inside knowledge or by observing system behavior in response to invalid inputs. When the attacker identifies scenarios where SQL querie...
Fix Text (Documentation Requirement)
Where dynamic code execution is used, modify the code to implement protections against code injection. When the objective could practically be satisfied by static execution with strongly typed parameters, modify the code to do so.