STIGQter STIGQter: STIG Summary: MariaDB Enterprise 10.x Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Apr 2026:

MariaDB and associated applications must reserve the use of dynamic code execution for situations that require it.

DISA Rule

SV-253715r961158_rule

Vulnerability Number

V-253715

Group Title

SRG-APP-000251-DB-000391

Rule Version

MADB-10-005800

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Where dynamic code execution is employed in circumstances where the objective could practically be satisfied by static execution with strongly typed parameters, modify the code to do so.

Check Contents

Review MariaDB source code (stored procedures, functions, triggers) and application source code, to identify cases of dynamic code execution.

To list all stored procedures, functions, and triggers in the database, as the database administrator, run the following SQL:

MariaDB> SHOW FUNCTION STATUS;
MariaDB> SHOW PROCEDURE STATUS;
MariaDB> SHOW TRIGGERS;

Any user input should be handled through prepared statements.

If dynamic code execution is employed in circumstances where the objective could practically be satisfied by static execution with strongly typed parameters, this is a finding.

Vulnerability Number

V-253715

Documentable

False

Rule Version

MADB-10-005800

Severity Override Guidance

Review MariaDB source code (stored procedures, functions, triggers) and application source code, to identify cases of dynamic code execution.

To list all stored procedures, functions, and triggers in the database, as the database administrator, run the following SQL:

MariaDB> SHOW FUNCTION STATUS;
MariaDB> SHOW PROCEDURE STATUS;
MariaDB> SHOW TRIGGERS;

Any user input should be handled through prepared statements.

If dynamic code execution is employed in circumstances where the objective could practically be satisfied by static execution with strongly typed parameters, this is a finding.

Check Content Reference

M

Target Key

5475