SQL_Injection

💉 SQL Injection (SQLi)

📌 Description

SQL Injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It can allow attackers to view data they are normally not able to retrieve, and even modify or delete data.

🔍 Common Vectors

• Authentication Bypass: Using payloads like admin' # or ' OR 1=1 -- to skip password checks.
• Data Extraction: Using UNION SELECT to retrieve data from other tables.
• Error-Based: Forcing the database to reveal information through error messages.

🛠️ Mitigations

1. Parameterized Queries: Use prepared statements (e.g., PDO in PHP).
2. Input Validation: Only allow expected characters.
3. Least Privilege: Ensure the database user has limited permissions.

🏷️ Related Machines

• 📅 Appointment