A classification of SQL injection attacking vector as of 2010
In computing, SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).[1][2] SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.
SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server. Document-oriented NoSQL databases can also be affected by this security vulnerability.[3]
SQL injection remains a widely recognized security risk due to its potential to compromise sensitive data. The Open Web Application Security Project (OWASP) describes it as a vulnerability that occurs when applications construct database queries using unvalidated user input. Exploiting this flaw, attackers can execute unintended database commands, potentially accessing, modifying, or deleting data. OWASP outlines several mitigation strategies, including prepared statements, stored procedures, and input validation, to prevent user input from being misinterpreted as executable SQL code.[4]
History
[edit]Discussions of SQL injection began in the late 1990s, including in a 1998 article in Phrack Magazine.[5] SQL injection was ranked among the top 10 web application vulnerabilities of 2007 and 2010 by the Open Web Application Security Project (OWASP).[6] In 2013, SQL injection was listed as the most critical web application vulnerability in the OWASP Top 10.[7]
In 2017, the OWASP Top 10 Application Security Risks grouped SQL injection under the broader category of "Injection," ranking it as the third most critical security threat. This category included various types of injection attacks, such as SQL, NoSQL, OS command, and LDAP injection. These vulnerabilities arise when an application processes untrusted data as part of a command or query, potentially allowing attackers to execute unintended actions or gain unauthorized access to data.[8]
By 2021, injection remained a widespread issue, detected in 94% of analyzed applications, with reported incidence rates reaching up to 19%. That year’s OWASP Top 10 further expanded the definition of injection vulnerabilities to include attacks targeting Object Relational Mapping (ORM) systems, Expression Language (EL), and Object Graph Navigation Library (OGNL). To address these risks, OWASP recommends strategies such as using secure APIs, parameterized queries, input validation, and escaping special characters to prevent malicious data from being executed as part of a query.[9][10]
Root cause
[edit] |
SQL injection is a common security vulnerability that arises from letting attacker-supplied data become SQL code. This happens when programmers assemble SQL queries either by string interpolation or by concatenating SQL commands with user supplied data. Therefore, injection relies on the fact that SQL statements consist of both data used by the SQL statement and commands that control how the SQL statement is executed. For example, in the SQL statement select * from person where name = 'susan' and age = 2 the string 'susan' is data and the fragment and age = 2 is an example of a command (the value 2 is also data in this example).
SQL injection occurs when specially crafted user input is processed by the receiving program in a way that allows the input to exit a data context and enter a command context. This allows the attacker to alter the structure of the SQL statement which is executed.
As a simple example, imagine that the data 'susan' in the above statement was provided by user input. The user entered the string 'susan' (without the apostrophes) in a web form text entry field, and the program used string concatenation statements to form the above SQL statement from the three fragments select * from person where name=', the user input of 'susan', and ' and age = 2.
Now imagine that instead of entering 'susan' the attacker entered ' or 1=1; --.
The program will use the same string concatenation approach with the 3 fragments of select * from person where name=', the user input of ' or 1=1; --, and ' and age = 2 and construct the statement select * from person where name='' or 1=1; --' and age = 2. Many databases will ignore the text after the '--' string as this denotes a comment. The structure of the SQL command is now select * from person where name='' or 1=1; and this will select all person rows rather than just those named 'susan' whose age is 2. The attacker has managed to craft a data string which exits the data context and entered a command context.
Ways to exploit
[edit]Although the root cause of all SQL injections is the same, there are different techniques to exploit it. Some of them are discussed below:
Getting direct output or action
[edit]Imagine a program creates a SQL statement using the following string assignment command :
var statement = "SELECT * FROM users WHERE name = '" + userName + "'";
This SQL code is designed to pull up the records of the specified username from its table of users. However, if the "userName" variable is crafted in a specific way by a malicious user, the SQL statement may do more than the code author intended. For example, setting the "userName" variable as:
' OR '1'='1
or using comments to even block the rest of the query (there are three types of SQL comments[11]). All three lines have a space at the end:
' OR '1'='1' -- ' OR '1'='1' }: CS1 maint: numeric names: authors list (link)
}: CS1 maint: deprecated archival service (link)
External links
[edit]- OWASP SQL Injection Cheat Sheets, by OWASP.
- WASC Threat Classification - SQL Injection Entry, by the Web Application Security Consortium.
- Why SQL Injection Won't Go Away Archived November 9, 2012, at the Wayback Machine, by Stuart Thomas.
- SDL Quick security references on SQL injection by Bala Neerumalla.
- How security flaws work: SQL injection
