Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
The application must not be vulnerable to SQL Injection.
Description
Discussion Text
SQL Injection is a code injection attack against database applications. Malicious SQL statements are inserted into an application data entry field where they are submitted to the database and executed. This is a direct result of not validating input that is used by the application to perform a command or execute an action.
Successful attacks can read data, write data, execute administrative functions within the database, shutdown the DBMS, and in some cases execute OS commands.
Best practices to reduce the potential for SQL Injection vulnerabilities include:
Not using concatenation or replacement to build SQL queries.
Using prepared statements with parameterized queries that have been tested and validated not to be vulnerable to SQL Injection.
Using stored procedures that have been tested and validated not to be vulnerable to SQL Injection.
Escaping all user supplied input.
Additional steps to prevent SQL Injection can be found at the OWASP website:
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
Successful attacks can read data, write data, execute administrative functions within the database, shutdown the DBMS, and in some cases execute OS commands.
Best practices to reduce the potential for SQL Injection vulnerabilities include:
Not using concatenation or replacement to build SQL queries.
Using prepared statements with parameterized queries that have been tested and validated not to be vulnerable to SQL Injection.
Using stored procedures that have been tested and validated not to be vulnerable to SQL Injection.
Escaping all user supplied input.
Additional steps to prevent SQL Injection can be found at the OWASP website:
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.