Details
Alert ID 90018
Alert Type Active
Status beta
Risk High
CWE 89
WASC 19
Technologies Targeted Db / Firebird
Db / HypersonicSQL
Db / IBM DB2
Db / Microsoft Access
Db / Microsoft SQL Server
Db / MySQL
Db / Oracle
Db / PostgreSQL
Db / SAP MaxDB
Db / SQLite
Tags OWASP_2017_A01
OWASP_2021_A03

Summary

A SQL injection may be possible using the attached payload

Solution

Do not trust client side input, even if there is client side validation in place. In general, type check all data on the server side. If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?' If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries. If database Stored Procedures can be used, use them. Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality! Do not create dynamic SQL queries using simple string concatenation. Escape all data received from the client. Apply an 'allow list' of allowed characters, or a 'deny list' of disallowed characters in user input. Apply the privilege of least privilege by using the least privileged database user possible. In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact. Grant the minimum database access that is necessary for the application.

Other Info

References

Code

org/zaproxy/zap/extension/sqliplugin/SQLInjectionScanRule.java