A05:2025 — Injection

01 Core Injection Mechanisms

Injection flaws emerge whenever application input boundaries fail to cleanly separate data parameters from control instructions in downstream interpreters:

SQL Injection (SQLi): Dynamic concatenation of raw user input into SQL statement strings executed via PDO, MySQLi, or raw ORM query builders.
OS Command Injection: Passing unvalidated shell arguments to process execution sinks such as exec(), system(), passthru(), or child_process.exec().
Server-Side Template Injection (SSTI): Concatenating untrusted strings directly into template engine render pipelines (Twig, Smarty, Jinja2, Blade).
NoSQL / LDAP / XPath Injection: Malformed filter objects manipulating query logic in document databases (e.g. MongoDB $where, $gt operators) or directory lookups.

02 Vulnerability Demonstration & Test Triggers

Vulnerable Implementation: Dynamic SQL Concatenation

Direct concatenation of user request parameters into raw database queries.

vulnerable_query.phpPHP

// VULNERABLE: Direct string interpolation into SQL query
function getUserProfile($db, $userId) {
    $sql = "SELECT id, username, email, role FROM users WHERE id = " . $userId;
    $result = $db->query($sql);
    return $result->fetch(PDO::FETCH_ASSOC);
}

Reproduction & Verification Procedure

1

Benign Boolean Testing:

Send a standard test query with boolean conditions to determine if the query syntax structure is altered.

GET /api/user?id=1%20OR%201=1 HTTP/1.1
Host: target.internal

2

Analyze Response Differential:

Compare responses for 1 AND 1=1 versus 1 AND 1=2 to confirm blind inference pathways.

03 Audit & Static Code Analysis Rules

Static signatures for identifying dangerous injection sinks:

Injection Type	Grep / AST Pattern	Remediation Requirement
Direct SQL Query	`\$db->query\(.*\$_(GET\|POST\|REQUEST)`	Parameterized Prepared Statements
Raw OS Exec	`(exec\|system\|passthru\|shell_exec)\(`	`proc_open()` with strict array args
Raw Template Eval	`(Twig\|Blade)::render\(['"].*\$`	Template Context Parameter Binding

04 Hardened Remediation Standards

Secure Parameterized Queries with PDO

secure_query.phpPHP 8+

// SECURE: Parameterized Query using PDO prepared statements
function getSecureUserProfile(PDO $pdo, int $userId): ?array {
    $stmt = $pdo->prepare("
        SELECT id, username, email, role 
        FROM users 
        WHERE id = :id AND is_active = 1
        LIMIT 1
    ");
    
    // Explicit type-bound parameter
    $stmt->bindValue(':id', $userId, PDO::PARAM_INT);
    $stmt->execute();
    
    $user = $stmt->fetch(PDO::FETCH_ASSOC);
    return $user ?: null;
}

// SECURE: Process execution without shell interpolation
function secureSystemUtility(string $targetIp): string {
    // 1. Strict input validation with whitelist/regex
    if (!filter_var($targetIp, FILTER_VALIDATE_IP)) {
        throw new InvalidArgumentException("Invalid IP address");
    }
    
    // 2. Safe execution passing arguments as explicit array
    $process = proc_open(
        ['/usr/bin/ping', '-c', '3', $targetIp],
        [1 => ['pipe', 'w'], 2 => ['pipe', 'w']],
        $pipes
    );
    
    $output = stream_get_contents($pipes[1]);
    fclose($pipes[1]);
    fclose($pipes[2]);
    proc_close($process);
    
    return $output;
}

05 Verification & Compliance Checklist

Verification Control	Standard	Status
Parameterized Queries	100% of dynamic SQL queries use parameterized bindings.	Enforced
ORM Hardening	Raw string interpolation in ORM methods strictly banned via linter.	Enforced
Input Validation	Strict data typing (int, UUID, enum whitelist) on all entry endpoints.	Enforced