Injection
Injection flaws occur when an application sends hostile data to an interpreter. This includes SQL, NoSQL, OS command, ORM, LDAP, and Expression Language injection.
概要
Injection slides down to #3. 94% of applications were tested for some form of injection. The 33 CWEs mapped into this category have the second most occurrences in applications.
攻撃者がこれを悪用する方法
攻撃パターンを理解することで、より優れた防御を構築できます。これらはセキュリティチームが監視する技術です。
SQL query manipulation
User input is incorporated into database queries without proper sanitization, allowing attackers to modify query logic or extract unauthorized data.
Command execution
User input flows into system commands, allowing attackers to execute arbitrary commands on the server.
Script injection in pages
User content is reflected in web pages without encoding, allowing script execution in other users' browsers.
予防方法
- Use a safe API which avoids using the interpreter entirely
- Use parameterized queries or prepared statements
- Use positive server-side input validation
- Escape special characters for any residual dynamic queries
- Use LIMIT and other SQL controls to prevent mass disclosure
Shoulder検出付きCWE (9)
これらのCWEにはShoulder検出ルールがあります。クリックして特定の脆弱性と修正を確認してください。
その他のマップされたCWE (24)
これらのCWEはこのカテゴリにマップされていますが、まだShoulderルールがありません。