Description

SQL injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements that control a web application's database server.

Remediation

Use parameterized queries when dealing with SQL queries that contain user input. Parameterized queries allow the database to understand which parts of the SQL query should be considered as user input, therefore solving SQL injection.

References

SQL Injection (SQLi) - Acunetix

Types of SQL Injection (SQLi) - Acunetix

Prevent SQL injection vulnerabilities in PHP applications and fix them - Acunetix

SQL Injection - OWASP

Bobby Tables: A guide to preventing SQL injection

SQL Injection Cheet Sheets - Pentestmonkey

Related Vulnerabilities

WordPress Plugin Contact Form 'wpcf_easyform_formid' Parameter SQL Injection (2.7.5)

WordPress Plugin Simple Login Log SQL Injection (1.1.1)

WordPress Plugin WP Maps-Display Google Maps Perfectly with Ease SQL Injection (4.0.4)

WordPress Plugin WP Symposium Multiple Vulnerabilities (14.10)

WordPress Plugin Export any WordPress data to XML/CSV SQL Injection (1.3.4)

Severity

Critical

Classification

CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

SQL Injection