system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
import re
import logging
from rest_framework import generics
from rest_framework import response
from rest_framework import status
from bluebottle.payments_logger.models import PaymentLogLevels, PaymentLogEntry

logger = logging.getLogger(__name__)


# TODO: limit status change notifications to docdata IPs
class GenericStatusChangedNotificationView(generics.GenericAPIView):
    def get(self, request, *args, **kwargs):

        # is it 'order' what I am looking for?
        if 'order' in request.query_params:
            order_id = request.query_params['order']
            if re.match('^[0-9]+-[0-9]+$', order_id):

                # Try to find the payment for this order.
                payment = self._find_payment(order_id)

                # Update the status for the payment.
                self._update_status(payment, order_id)

                # Return 200 as required by DocData when the status changed notification was consumed.
                return response.Response(status=status.HTTP_200_OK)
            else:
                logger.error(
                    'Could not match order {0} to update payment status.'.format(
                        order_id))
        return response.Response(status=status.HTTP_403_FORBIDDEN)

    def _update_status(self, payment, order_id):
        status_log = PaymentLogEntry(payment=payment,
                                     level=PaymentLogLevels.info)
        status_log.message = 'Received status changed notification for merchant_order_reference {0}.'.format(
            order_id)
        status_log.save()

        # The following we had in cowry_docdata, don't know if we need it here.
        # if so we have to implement a update_payment_status method in the adapter(?)
        # payments.update_payment_status(payment, status_changed_notification=True)

    def _find_payment(self, order_id):
        # TODO: To be implemented in the sub classes
        # for example like this
        # try:
        #     payment = PaymentClass.objects.get(merchant_order_reference=order_id)
        # except PaymentClass.DoesNotExist:
        #     logger.error('Could not find order {0} to update payment status.'.format(order_id))
        #     return response.Response(status=status.HTTP_403_FORBIDDEN)
        # return payment
        pass

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-943: Improper Neutralization of Special Elements in Data Query Logic
  B) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  C) CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  D) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  E) CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')
  F) CWE-117: Improper Output Neutralization for Logs
Answer: F