SQL Injection

Rank 3 in the 2024 CWE Top 25 (frequency x severity of CVEs). SQL Injection: user input is incorporated into an SQL query without proper neutralisation, allowing modification of query logic and unauthorised data access.

Use parameterised queries instead of placing user input into query strings, to prevent SQL injection.

Application code scanners, which analyse source, binary or byte code for security flaws, malicious code and back doors, must be used whenever possible and particularly in development so flagged code is remediated before release, with mitigations such as IDS or...

The device validates application-layer data entered through user interfaces against unexpected input, to prevent manipulation and failure, for example discarding input that would enable SQL injection. Status in Table B.1: M (mandatory, a shall provision).

Applications, including web applications facing the internet, are tested against known attack types such as SQL injection, cross-site scripting and buffer overflow before implementation and after significant change.

Intermediate control principles for secure development (required, with baseline, of an AI whose inherent risk is medium). Processes mitigate vulnerabilities found during secure development;