PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The State of SQL Injection

aikido.dev | blog | #sql-injection | #input-validation | #data-breach | #moveit | #sqli | #vulnerability-statistics
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

SQL injection predates Internet Explorer, yet 6.7% of 2024 open-source vulnerabilities were SQLi and over 20% of scanned closed-source projects remain vulnerable. The MOVEit breach proves the point.
Published
Collected

Related coverage

blog · aikido.dev
Command injection in 2024 unpacked
Unvalidated input passed to system functions still enables arbitrary command execution. Aikido research finds command injection at 7% of 2024 open-source vulnerabilities—still surprisingly common.
blog · aikido.dev
Path Traversal in 2024 - The year unpacked
Path traversal is ancient but trending the wrong way: 2.7% of 2024 open-source vulnerabilities, closed-source up 85%. The post shows how ../ attacks reach /etc/passwd and how to stop them.
vulnerability · horizon3.ai
MOVEit Transfer CVE-2023-34362 Deep Dive and Indicators of Compromise
Technical Deep-Dive and Indicators of Compromise for MOVEit Transfer CVE-2023-34362 SQL Injection to Remote Code Execution Vulnerability
blog · aikido.dev
Prisma and PostgreSQL vulnerable to NoSQL injection? A surprising security risk explained
Prisma queries accept operator objects that attackers can abuse, so crafted input can bypass password checks even on PostgreSQL. The post demonstrates operator injection exploits and defenses.
blog · aikido.dev
Webhook security checklist: How to build secure webhooks
Carelessly built webhooks invite SSRF and data leaks. The checklist covers URL validation, blocking local addresses, limiting log exposure, and HMAC payload verification for consumer trust.
blog · aikido.dev
Top 3 web application security vulnerabilities in 2024
Aikido ranks the top three web application vulnerabilities among its users, starting with NoSQL injection, explaining why each is common, how to fix them, and risky runner-up flaws to watch.
Back