SQL Injection



Description

SQL injection is a type of vulnerability in database access code that allows attackers to execute unauthorized queries on the database. SQL injection typically occurs when an application uses input to construct dynamic SQL statements to access the database. SQL injection may also occur if stored procedures use dynamic queries that include untrusted input. Using the SQL injection attack, an attacker can execute arbitrary commands on the database with the privileges of the application. SQL injection applies to all applications that query SQL databases.

Impact

SQL injection allows the attacker to access any data in the database. The attacker will usually use this to extract any sensitive data from the database. If there are any passwords in the database, the attacker is likely to try to use them to login as the administrator and take over the application or the server. Some database servers allow so-called "stacked queries". "Stacked queries" allow executing multiple queries separated by a semi-colon from one string. If "stacked queries" are enabled, SQL injection allows the attacker to execute any queries on the database server. This usually allows the attacker to take full control of the application. Many database servers also allow executing arbitrary operating system commands. The attacker may abuse that functionality with SQL injection to take full control of the application or the server.

Countermeasures

To prevent this problem, validate all input and use parameterized APIs for database access.

Application Check

To check for adequate protection against this vulnerability, find all queries generated by the application and verify that all user input is validated.

Specific Technologies

!Have a comment about this article? Send our team an email.