A05: Injection · 2025

Untrusted data is interpreted as commands or queries

Summary

Untrusted data is interpreted as commands or queries. Injection can alter queries, execute instructions or access information outside the intended flow.

How the attack works

The payload ' OR '1'='1 is concatenated into SQL, making the WHERE condition true and returning rows outside the intended search.

Example

Vulnerable · Pseudocode

name = "' OR '1'='1"
sql = "SELECT id FROM users\n" +
      "WHERE name = '" + name + "'"
db.query(sql)

Fix: Use db.query("SELECT id FROM users WHERE name = ?", [name]).

Prevention

Use parameterized APIs and avoid concatenating input into commands.
Validate against allowlists when parameterization is not possible.
Separate data from instructions and test entry points with adversarial cases.

Lineage

2013 · A1: Injection Continues in 2017
2013 · A3: Cross-Site Scripting (XSS) Moves down to rank 7 in 2017
2017 · A1: Injection Continues
2017 · A7: Cross-Site Scripting (XSS) Integrated into Injection
2021 · A03: Injection Absorbs XSS
2025 · A05: Injection Moves down from rank 3

2013:A1 → 2017:A1: Injection retains rank 1.
2013:A3 → 2017:A7: XSS moves down from rank 3 to 7.
2017:A1 → 2021:A03: Injection moves down from rank 1 to 3.
2017:A7 → 2021:A03: XSS is integrated into Injection.
2021:A03 → 2025:A05: Injection moves down from rank 3 to 5.

Sources

Open official source ↗

Buy me a coffee