SQL injection
Description
Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures.
Impact
Inject SQL statements, with the possibility of obtaining information about the database, as well as extract information from it.
Recommendation
Perform queries to the database through sentences or parameterized procedures.
Threat
Authenticated attacker from the Internet.
Expected Remediation Time
⏱️ 30 minutes.