Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses

Opis

The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities.

While the interpretation of "large number of data accesses/queries" may vary for each product or developer, CISQ recommends a default maximum of 2 data accesses per function/method.

Skutki

• Other

  Reduce Performance

  This issue can make the product perform more slowly. If the relevant code is reachable by an attacker, then this performance problem might introduce a vulnerability.

Słabość nadrzędna

• CWE-405 Asymmetric Resource Consumption (Amplification)

Kiedy powstaje

• Architecture and Design

Dotyczy

SQL, Database Server

Źródła

1. Automated Source Code Performance Efficiency Measure (ASCPEM) — Object Management Group (OMG), ASCPEM-PRF-10, 2016