Description
Hibernate ORM is an object-relational mapping tool for the Java programming language. It provides a framework for mapping an object-oriented domain model to a relational database. Hibernate Query Language (HQL) injection refers to an injection attack wherein an attacker tamper with the HQL query to execute malicious SQL statements that control a web application's database server.
Remediation
Use parameterized queries when dealing with HQL queries that contain user input. Parameterized queries allow the database to understand which parts of the HQL query should be considered as user input, therefore solving HQL injection.
References
Related Vulnerabilities
WordPress Plugin Captcha by BestWebSoft SQL Injection (4.1.7)
WordPress Plugin FV Flowplayer Video Player SQL Injection (7.5.15.727)
WordPress Plugin KNR Author List Widget 'listItem[]' Parameter SQL Injection (2.0.0)
WordPress Plugin PayPlus Payment Gateway SQL Injection (7.0.7)
WordPress Plugin All-In-One Security (AIOS)-Security and Firewall SQL Injection (4.0.8)