📋 What Is It?
Injection - Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query.
#1
OWASP Rank 2017
8%
Apps Tested
274K
Occurrences
⚠️ Common Exploits
- SQL Injection: Manipulate database queries
- OS Command Injection: Execute system commands
- LDAP Injection: Manipulate directory services queries
- XPath Injection: Manipulate XML data queries
- NoSQL Injection: Exploit NoSQL databases
🔴 Attack Flow
1. Attacker identifies input field
↓
2. Submits malicious input with special characters
↓
3. Application fails to validate/sanitize input
↓
4. Malicious code executed by interpreter
↓
5. BREACH: Data exfiltration or system compromise!
↓
2. Submits malicious input with special characters
↓
3. Application fails to validate/sanitize input
↓
4. Malicious code executed by interpreter
↓
5. BREACH: Data exfiltration or system compromise!
✓ Prevention Checklist
- Use parameterized queries (prepared statements)
- Use Object Relational Mapping (ORM) frameworks
- Validate and sanitize all user input
- Apply whitelist input validation
- Use LIMIT and other SQL controls to prevent mass disclosure
📌 Quick Reference
Risk Level: CRITICAL RISK
Year: OWASP Top 10 2017
Category: WEB
Ranking: #1 in 2017