SQL Injection

CriticalWeb Application SecurityA03:2021 – Injection

An attacker inserts or manipulates SQL queries through unsanitized user input, allowing unauthorized access to, modification of, or deletion of database records.

Immediate Response

1Isolate the affected endpoint and apply a WAF rule to block injection patterns immediately.
2Review application and database logs for evidence of data exfiltration or data manipulation.
3Reset all database credentials and rotate secrets.
4Notify data protection officer if personal data may have been accessed.

All playbooks

1Replace all dynamic query construction with parameterized queries or prepared statements.
2Enforce least-privilege database accounts: application user should only have SELECT/INSERT on required tables.
3Deploy or tune WAF rules targeting SQLi payloads (OWASP CRS ruleset).
4Enable database audit logging to capture all query activity.

Long-term Prevention

1Integrate SAST tools (e.g., Semgrep, SonarQube) in CI/CD to detect raw query concatenation.
2Add DAST scans (e.g., OWASP ZAP, Burp Suite) targeting SQLi on every release.
3Conduct developer training on parameterized queries and ORM safe usage.
4Implement input validation at the API boundary: whitelist expected formats, reject anomalies.

Attack vectors

Unparameterized query strings built with user input
Stored procedures that concatenate raw input
ORM misuse bypassing built-in escaping
Second-order injection via stored data later used in queries

Indicators of compromise

Unusual database error messages in application logs
Spikes in failed authentication attempts against the DB
Unexpected data exfiltration in network traffic
Database queries with UNION, SELECT, OR 1=1 patterns in logs

Tooling

OWASP ZAPBurp Suitesqlmap (authorized testing)SonarQubeSemgrep