01 — Vulnerability Overview: SQL Injection (CWE-89)

Quick Facts

The Problem

SQL Injection (SQLi) is the process of inserting malicious SQL code into legitimate user input fields, allowing attackers to manipulate database queries and access unauthorized data.

Vulnerable Code Pattern:

# VULNERABLE - Python with SQLite
username = request.form['username']
password = request.form['password']

query = "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'"
cursor.execute(query)

Attack Payload:

Username: ' OR '1'='1
Password: anything

-- Resulting query becomes:
SELECT * FROM users WHERE username='' OR '1'='1' AND password='anything'

-- This returns ALL users regardless of password (authentication bypass)

Impact Assessment

Scale

• Affected Platforms: 1,000,000+ configurations (all web applications)
• Industries: Every industry with database-driven applications
  • Finance (banking, trading, payment processing)
  • Healthcare (patient records, EHR systems)
  • E-commerce (customer data, transactions)
  • Government (citizen records, internal systems)
  • Education (student information systems)

Attack Progression

1. Read Unauthorized Data
   - Customer records, credit cards, SSNs
   - Trade secrets, intellectual property
   - Authentication credentials

2. Modify Data
   - Change prices, quantities in e-commerce
   - Modify user permissions/roles
   - Alter transaction records

3. Delete Data
   - Erase transaction logs
   - Remove audit trails
   - Destroy evidence of intrusion

4. Execute Administrative Operations
   - Create database users with admin privileges
   - Shutdown database servers
   - Execute OS commands (database-dependent)

5. Extract Data
   - Exfiltrate entire databases
   - Download sensitive files

Severity Drivers

Why is SQL Injection so dangerous? 1. Databases hold sensitive data — Customer records, payments, secrets 2. Direct access — Attacker bypasses application logic entirely 3. Privilege escalation — Can execute database commands as admin 4. Audit trail destruction — Can delete logs covering the attack 5. Lateral movement — Database often central to IT infrastructure

Real-World Incidents

Pattern: SQL Injection appears in nearly 50% of major data breaches

Timeline

Why SQL Injection Persists

Despite being 25+ years old: - Developers still concatenate user input into SQL queries - Legacy applications lack input validation - New frameworks help but misconfiguration still possible - Complex SQL allows subtle injection vectors

Common Mistakes: - Blacklist approach ("filter out dangerous characters") — Easy to bypass - Type checking only ("only accept numbers") — String concatenation still vulnerable - Web Application Firewall false sense of security — Skilled attackers bypass WAF

KGCS Context

In the KGCS Graph

This CWE demonstrates why KGCS matters at scale:

CWE-89 (General SQL Injection)
  ├─ Specific CVEs (100+ different database systems)
  ├─ DEMONSTRATED_BY → CAPEC-66 (SQL Injection)
  ├─ DEMONSTRATED_BY → CAPEC-250 (XML Injection patterns)
  └─ IMPLEMENTS → Multiple ATT&CK Techniques:
       - T1190 (Exploit Public-Facing Application)
       - T1565 (Data Manipulation)
       - T1078 (Valid Accounts)

Graph Statistics

• Root Weakness: CWE-89
• Related CVEs: 100+ across:
  • MySQL/MariaDB
  • PostgreSQL
  • Oracle Database
  • SQL Server
  • SQLite
  • MongoDB (NoSQL variation)
• Attack Patterns: 3 (CAPEC-66, CAPEC-250, CAPEC-465)
• Affected Platforms: 1,000,000+ (all web apps with databases)
• Defensive Controls: 20+ (parameterized queries, WAF rules, input validation)

Detection Landscape

Why is SQLi hard to detect? - Legitimate SQL uses similar character patterns - Obfuscation techniques bypass simple string matching - Blind SQL injection (no visible error) is undetectable by output monitoring - Time-based detection requires specific logging

Next Steps

Read: 02 Root Cause Analysis — Understand SQL injection internals

Skip to: 05 Defense Playbook — Immediate mitigation strategies

Sources: OWASP, CWE-89 Definition, Historic breach reports, SQL Injection documentation