Uncle Sam's had it up to here with 'unforgivable' SQL injection flaws

The US has clearly had enough of software vendors shipping products with "unforgivable" vulnerabilities, and is now urging them to launch formal code reviews to stamp out SQL injection flaws. The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) issued a Secure by Design Alert on Monday, reminding the tech community that there is no excuse for the decades-old vulnerability type to still be causing issues today. They cited the MOVEit supply chain attacks from last year, ones enabled by a SQL injection zero day, as an example of the damage such issues can cause. Defunct ransomware and extortion outfit Cl0p was responsible for the MOVEit MFT attacks last year. Cybersecurity biz Emsisoft set up a web page to track the number of victims and despite Progress Software releasing patches fairly quickly, the group was responsible for breaches at 2,769 organizations, as of this week's data. This meant that around 95 million individuals have been affected so far. The call from authorities extends to software vendors' customers too. They've been advised to hold their vendors to account by asking them if a formal code review into a product's susceptibility to SQL injection exploits has occurred and what mitigations have been put in place. SQL injection vulnerabilities exist where developers allow user-input data to be supplied to a database directly as a SQL command. This can then lead to all manner of nastiness, including the modification or...