Vulnerability A1 Injection currently holds the 1st position in the OWASP Top 10 ranking, which means it is responsible for a significant portion of public disclosures and security breaches.

So, what is an injection vulnerability? Well, there are several types. Some of the most common types include SQL Injection, code injection, and LDAP injection. When using various injection types, an attacker will construct their attack differently.

SQL is a structured query language that allows interaction with database servers. SQL commands like INSERT, RETRIEVE, UPDATE, and DELETE are used to perform operations on the database.

SQL Injection is a method where an attacker utilizes unvalidated input vulnerabilities and injects SQL commands through a web application that are executed in the server’s database.

Connect to Database Server

SQL Injection

Database Connection:

In this context, the attacker can enter the network without providing any authentication and gain the highest privileges.

Information Disclosure:

After entering the network, the attacker gains access to confidential data stored within the network.

Data Integrity Breach:

The attacker alters the content of the website by introducing malicious content.

Compromised Data Availability:

Using this method, the attacker removes confidential and critical information from the database.

Remote Code Execution:

The attacker can modify, delete, or create data or even create new user accounts with full permissions on servers that share files and folders. This allows the attacker to compromise the host’s operating system.

Significant Risks:

Vulnerabilities related to A1 injections represent some of the most significant risks when effectively exploited. Some of these risks include:

  • Data loss or corruption.
  • Data theft.
  • Unauthorized access.
  • Denial of service.
  • Complete takeover of the host system.

SQL Query Vulnerable to Attack:

SQL
select count (*) FROM Users WHERE UserName=' " + txtUser.Text + " ' AND passwords=' " + txtpassword.Text + " ' ";

Similarly, plain text in the framework makes the framework vulnerable.

Java
Query HQLQuery = session.createQuery("FROM accounts WHERE custID='" + request.getParameter("id") + "'");

Understanding SQL Injections:

In normal circumstances, this will probably be translated to SELECT * FROM test WHERE ID = 1. “test” might be a table name, and it merely selects ID 1 from the table. We need to look at information from a different class.

  • Trusted data: http://mydomain.com/test?Id
  • Untrusted data: 1

The first part we should see here is what trusted data (http://mydomain.com/test?Id) and untrusted data (1) are, with untrusted being the vulnerable one. Now, what happens if an attacker adds a condition http://mydomain.com/test?Id=1 or 1=1? If this condition passes through the database, it will alter the login. Instead of extracting just one identifier, it will retrieve the entire database.

Common Means of Protection

  1. Whitelisting of Untrusted Data:

    • Why do we need trust?
    • Does it match expected patterns?

  2. SQL Statement Parameterization:

    • Separate the query from input data.
    • Perform casting of each operator.

  3. Fine-Tuned Database Permissions:

    • Segregate admin and public accounts.
    • Apply the “least privilege principle.”

CyberAstral

“We are cyber guardians of the galaxy.
We protect the cyber world from cyber threats all over the galaxy! 👾”