PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Command injection in 2024 unpacked

aikido.dev | blog | #secure-coding | #web-security | #owasp | #input-validation | #command-injection | #vulnerability-statistics
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Unvalidated input passed to system functions still enables arbitrary command execution. Aikido research finds command injection at 7% of 2024 open-source vulnerabilities—still surprisingly common.
Published
Collected

Related coverage

blog · aikido.dev
Path Traversal in 2024 - The year unpacked
Path traversal is ancient but trending the wrong way: 2.7% of 2024 open-source vulnerabilities, closed-source up 85%. The post shows how ../ attacks reach /etc/passwd and how to stop them.
blog · aikido.dev
The State of SQL Injection
SQL injection predates Internet Explorer, yet 6.7% of 2024 open-source vulnerabilities were SQLi and over 20% of scanned closed-source projects remain vulnerable. The MOVEit breach proves the point.
blog · netspi.com
Performing Code Reviews to PCI Requirements
A NetSPI post maps PCI requirements to the OWASP Top 10 for code reviews, noting gaps like track-data retention rules that OWASP does not cover, since no single PCI code-review checklist exists.
blog · aikido.dev
The practical checklist for defending against supply chain attacks
A prioritized checklist for supply chain defense: package age policies before installs, pipeline dependencies pinned to commit SHAs, and MCP servers treated as high-trust dependencies.
blog · aikido.dev
How to maintain code quality standards with AI code and vibe coding
As AI-written code piles up faster than review can absorb, technical debt compounds until shipping slows; the piece covers pull-request quality checks and why model self-review is not enough.
blog · aikido.dev
Prisma and PostgreSQL vulnerable to NoSQL injection? A surprising security risk explained
Prisma queries accept operator objects that attackers can abuse, so crafted input can bypass password checks even on PostgreSQL. The post demonstrates operator injection exploits and defenses.
Back