Injection: SQL Injection¶

Identifier: frontend_sql_injection

Scanner(s) Support¶

GraphQL Scanner	REST Scanner	WebApp Scanner	ASM Scanner

Description¶

SQL injection vulnerabilities occur when frontend applications build SQL queries using untrusted user input without proper validation, allowing attackers to inject malicious SQL commands.

How we test: We inject SQL injection payloads into frontend request parameters and analyze responses to detect if SQL queries are executed. We test for various SQL injection techniques and check if user input is properly sanitized before being used in database queries.

Execution conditions (BLST):

Runs when this test is enabled and the request includes at least one argument.
Active SQL fuzzing runs only when baseline coverage is OK, EMPTY_RESPONSE, or VALIDATION_ERROR, and the baseline is not a 50x exchange.
Otherwise, the check performs passive SQL error-leakage detection on the current response.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  frontend_sql_injection:
    dedupe_query_params_by_name: true
    skip: false

Reference¶

`dedupe_query_params_by_name`¶

Type : boolean

When true, deduplicate fuzzing by parameter name across URLs. The same query param will be fuzzed only once across all URLs.

`skip`¶