A3:2021 | SQL Injection Intro (8) | Cycubix Docs

Severity of SQL injection

The severity of SQL injection attacks is limited by:

• Attacker’s skill and imagination.
• Defense in depth countermeasures.
  • Input validation.
  • Least privilege.
• Database technology.

Not all databases support command chaining:

• Microsoft Access.
• MySQL Connector/J and C
• Oracle

SQL injection is more common in PHP, Classic ASP, Cold Fusion and older languages:

• Languages that do not provide parameterized query support.
• Parameterized queries have been added to newer versions.
• Early adopters of web technology (i.e. Old Code).

Not all databases are equal (SQL Server):

• Command shell: master.dbo.xp_cmdshell 'cmd.exe dir c:'
• Registry commands: xp_regread, xp_regdeletekey, …