CISA urges software devs to weed out SQL injection vulnerabilities

CISA and the FBI urged executives of technology manufacturing companies to prompt formal reviews of their organizations' software and implement mitigations to eliminate SQL injection (SQLi) security vulnerabilities before shipping. In SQL injection attacks, threat actors "inject" maliciously crafted SQL queries into input fields or parameters used in database queries, exploiting vulnerabilities in the application's security to execute unintended SQL commands, such as exfiltrating, manipulating, or deleting sensitive data stored in the database. This can lead to unauthorized access to confidential data, data breaches, and even a complete takeover of the targeted systems because of improper input validation and sanitization in web applications or software that interact with the targeted databases. CISA and the FBI advise the use of parameterized queries with prepared statements to prevent SQL injection (SQLi) vulnerabilities. This approach separates SQL code from user data, making it impossible for malicious input to be interpreted as an SQL statement. Parameterized queries are a better option for a secure-by-design approach compared to input sanitization techniques because the latter can be bypassed and are difficult to enforce at scale. SQLi vulnerabilities took the third spot in MITRE's top 25 most dangerous weaknesses plaguing software between 2021 and 2022, only surpassed by out-of-bounds writes and cross-site scripting. "If they discover their code has vulnerabilities, s...