Security Test: SQL Injection via Frontend¶

Scanner(s) Support¶

Description¶

Default Severity: high

SQL injection happens when user input is directly incorporated into an SQL query without proper checks, allowing attackers to manipulate the query and run their own commands. This can lead to unauthorized access, changes to or loss of data, service disruptions, or even full system control. The main pitfall is assuming that user input is safe and not using techniques like parameterized queries or prepared statements, which are essential to block these kinds of attacks.

Reference:

• https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

Configuration¶

Identifier: frontend_injection/sql

Examples¶

All configuration available:

checks:
  frontend_injection/sql:
    skip: false # default

Compliance and Standards¶