CWE-1073 describes a client with a function or method that contains a large number of data accesses or queries sent through a data manager, without using efficient database capabilities. MITRE lists SQL and database server as the platforms. It affects application code that talks to a database through an ORM or helper layer.
How it happens
A method fetches a record, then fetches each related record one at a time, then fetches a count. Each call is a round trip.
MITRE notes the meaning of "large" varies, and CISQ recommends a default maximum of 2 data accesses per function or method.
// Pattern to avoid: three separate trips in one method
User u = dao.findUser(id);
List<Order> orders = dao.findOrders(id);
int total = dao.countOrders(id);
// Better: ask for what you need in one call
UserSummary s = dao.findUserSummary(id);
The single call can use a join or stored procedure inside the database, which does the work next to the data.
What an attacker gains
MITRE lists reduced performance. If an attacker can reach the code, the performance problem "might introduce a vulnerability." A single request can trigger many data trips, which multiplies the effect of a small flood of traffic.
How to find it
The record lists no detection methods. Count data calls per method in review and enable query counting in tests so a jump gets noticed.
How to fix it
- Combine related reads into one query, a view or a stored procedure.
- Fetch only the columns you need.
- Add a test that fails when an endpoint exceeds its expected number of queries.
Quick check
What default maximum does CISQ suggest here?
2 data accesses per function or method, though teams may interpret the threshold differently.
