Security Test: SQL Injection¶

Description¶

Default Severity: high

SQL injection happens when an application builds SQL queries using untrusted user input without proper checks, letting attackers sneak in their own commands. This flaw can let criminals read or change your data, shut down the database, or even gain control over your system. It usually occurs when developers put user input directly into queries without using safer methods like parameterized queries, leaving the door open for malicious manipulation. Ignoring proper input handling can lead to severe data breaches and system compromises, so it's crucial to always validate, sanitize, or use prepared queries for any user-supplied data.

Reference:

• https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

Configuration¶

Identifier: injection/sql

Examples¶

All configuration available:

checks:
  injection/sql:
    skip: false # default
    options:
      skip_objects: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶