SQL statement in request parameter

Description: SQL statement in request parameter

HTTP requests sometimes contain SQL syntax. If this is incorporated into a SQL query and executed by the server, then the application is almost certainly vulnerable to SQL injection.

When SQL-like syntax is observed, you should verify whether the request contains a genuine SQL query and whether this is being executed by the server.

Remediation: SQL statement in request parameter

Applications should not incorporate any user-controllable data directly into SQL queries. Parameterized queries (also known as prepared statements) should be used to safely insert data into predefined queries. In no circumstances should users be able to control or modify the structure of the SQL query itself.

References

• Web Security Academy: SQL injection
• Using Burp to Test for Injection Flaws
• Web Security Academy: SQL Injection Cheat Sheet

Vulnerability classifications

• CWE-598: Information Exposure Through Query Strings in GET Request
• CAPEC-66: SQL Injection

Typical severity

Medium

Type index (hex)

0x00400480

Type index (decimal)

4195456