SQL Injection via User-Controlled Input
Description
SQL Injections are a critical type of vulnerability that can lead to data or system compromise. By dynamically generating SQL query strings, user input may be able to influence the logic of the SQL statement. This could lead to an adversary accessing information they should not have access to, or in some circumstances, being able to execute OS functionality or code.
Examples
Insecure Code
python
User.objects.raw('SELECT * FROM myapp_user WHERE username = ' + request.GET['username'])Secure Code
python
uname = request.GET['username']; res = User.objects.raw('SELECT * FROM myapp_user WHERE username = %s', (uname,))Remediation
Replace all dynamically generated SQL queries with parameterized queries. Use django's QuerySets or pass user-supplied data to the `params` parameter of the `raw()` method.
Rule Details
| Field | Value |
|---|---|
| ID | CODE-0179 |
| Category | Injection |
| Severity | CRITICAL |
| CWE | CWE-89 |
| Confidence | HIGH |
| Impact | HIGH |
| Likelihood | HIGH |
| Exploitability | EASY |
| Tags | sql injection, parameterized queries |
| OWASP | A1:2017-Injection, A03:2021-Injection |