SQL Injection
Description
SQL Injection is a critical vulnerability that can lead to data or system compromise. By dynamically generating SQL query strings, user input may be able to influence the logic of the SQL statement. This could lead to an adversary accessing information they should not have access to, or in some circumstances, being able to execute OS functionality or code.
Examples
Insecure Code
python
cur.execute("select name from sqlite_master where name = '" + user_input + "'")Secure Code
python
params = ('user-input',); cur.execute("select name from sqlite_master where name =?", params)Remediation
Replace all dynamically generated SQL queries with parameterized queries. In situations where dynamic queries must be created, never use direct user input, but instead use a map or dictionary of valid values and resolve them using a user supplied key.
Rule Details
| Field | Value |
|---|---|
| ID | CODE-0162 |
| Category | Injection |
| Severity | HIGH |
| CWE | CWE-89 |
| Confidence | HIGH |
| Impact | HIGH |
| Likelihood | HIGH |
| Exploitability | EASY |
| Tags | SQL Injection, Parameterized Queries |
| OWASP | A1:2017-Injection, A03:2021-Injection |