A05—Injection

An application uses untrusted data in the construction of the following vulnerable SQL call: ``` String query = "SELECT * FROM accounts WHERE custID='" + request.getParameter("id") + "'"; ``` An attacker modifies the 'id' parameter value in their browser to send: `' OR '1'='1`. For example: ``` http://example.com/app/accountView?id=' OR '1'='1 ``` This changes the meaning of the query to return all records from the accounts table. More dangerous attacks could modify or delete data or even invoke stored procedures.

An application's blind trust in frameworks may result in queries that are still vulnerable. For example, Hibernate Query Language (HQL): ``` Query HQLQuery = session.createQuery("FROM accounts WHERE custID='" + request.getParameter("id") + "'"); ``` An attacker supplies: `' OR custID IS NOT NULL OR custID='`. This bypasses the filter and returns all accounts. While HQL has fewer dangerous functions than raw SQL, it still allows unauthorized data access when user input is concatenated into queries.

An application passes user input directly to an OS command: ``` String cmd = "nslookup " + request.getParameter("domain"); Runtime.getRuntime().exec(cmd); ``` An attacker supplies `example.com; cat /etc/passwd` to execute arbitrary commands on the server.