Injection (SQL, NoSQL, Command)
Attacker inserts malicious code into queries or commands by exploiting unsanitized user input — SQL injection, NoSQL injection, and OS command injection.
How It Works
Injection attacks occur when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing unintended commands or accessing data without authorization. SQL injection is the most common: an attacker inputs SQL syntax into a form field, and the application concatenates it directly into a query. This can dump the entire database, bypass authentication, or even execute system commands.
const userId = req.params.id;
const result = await db.query(
`SELECT * FROM users WHERE id = ${userId}`
);const userId = req.params.id;
const result = await db.query(
'SELECT * FROM users WHERE id = $1',
[userId]
);Real-World Example
The MOVEit Transfer SQL injection (CVE-2023-34362) was exploited by the Cl0p ransomware gang in 2023, compromising over 2,600 organizations and exposing data of 77+ million individuals including government agencies and Fortune 500 companies.
How to Prevent It
- Use parameterized queries or prepared statements
- Use an ORM like Prisma or Sequelize
- Validate and sanitize all user input
- Apply the principle of least privilege to database accounts
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Broken Access Control
highUsers can act outside their intended permissions, accessing other users' data or admin functionality without proper authorization checks.
Cryptographic Failures
highSensitive data is exposed due to weak or missing encryption — using outdated algorithms like MD5/SHA1, storing passwords in plaintext, or transmitting data without TLS.
Supply Chain Failures
mediumYour application inherits vulnerabilities from third-party dependencies — outdated packages with known CVEs that attackers actively exploit.
Security Misconfiguration
mediumDefault configurations, open CORS policies, debug mode in production, or verbose error messages expose your application to attackers.