CWE-89

What is CWE-89 (SQL Injection)?

SQL Injection (SQLi) is a critical web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It typically occurs when user input is incorrectly filtered for string literal escape characters embedded in SQL statements, or user input is not strongly typed and unexpectedly executed.

Impact on Systems

• Data Exfiltration: Unauthorized access to sensitive user data, financial records, or internal system configurations.
• Data Modification: Attackers can modify or delete database contents (Insert/Update/Delete operations), violating data integrity.
• Authentication Bypass: By manipulating login queries, attackers can log in as an administrator without knowing the password.
• Remote Code Execution: In certain configurations (e.g., using xp_cmdshell in SQL Server), an attacker can execute OS-level commands on the database server.

Vulnerability Signature

// Example of a vulnerable Node.js/Express snippet

const category = req.query.category;

// DANGEROUS: Direct string concatenation of user input
const query = `SELECT * FROM products WHERE category = '${category}'`;

db.query(query, (err, result) => {
  if (err) throw err;
  console.log(result);
});

Remediation

The most effective way to prevent SQL Injection is to use Parameterized Queries (Prepared Statements) or an Object-Relational Mapping (ORM) library that handles parameterization automatically.

1. Parametrized Queries

Use libraries that support secure parameter binding instead of concatenating raw strings.

// SECURED: Using parameterized queries avoids SQL injection
const category = req.query.category;

// Safe: The database driver treats '?' strictly as data, not executable code
const query = 'SELECT * FROM products WHERE category = ?';

db.query(query, [category], (err, result) => {
  if (err) throw err;
  console.log(result);
});

2. Input Validation

Implement strict input validation on the server side using allowlists rather than denylists. Ensure that input strongly matches expected data types (e.g., converting a string to an integer explicitly if an ID is expected).