SQL Injection
Critical · Injection
OWASP Top 10:2025 (current)
A05:2025 — Injection
Historical Top 10:2021 (not current)
A03:2021 — kept for older reports; use 2025 above.
CWE
CWE-89
CVE / class examples
- CVE-2019-9193 (illustrative class)
- Many product-specific SQLi CVEs
All refs
OWASP A05:2025 · OWASP A03:2021 · CWE-89
Definition
User input alters the structure of a database query.
Root cause
Concatenating untrusted input into SQL strings.
Affected components
- SQL databases
- ORM misuses
- Legacy string-built queries
Impact
Data theft, modification, auth bypass.
Severity
Critical
Safe lab reproduction
DVWA SQL Injection (local Docker)
Detection methodology
SQL errors, anomalous queries in DB logs, WAF alerts, SAST findings.
Evidence examples
- SQL error in response
- Boolean/time-based lab PoC (authorized)
Remediation
Parameterized queries, least-privilege DB accounts.
Secure coding examples
Use prepared statements / ORM bindings; never build SQL with string concatenation.
Related CYNARKS lessons & labs
Tools: sqlmap · burp · semgrep
Primary 2025 class: A05:2025 — Injection
Practise related skills in Labs or deepen on Academy library.