SQL Injection

In this public-facing web application variant, an attacker supplies SQL syntax through an input that the application incorporates unsafely into a database query. If the database executes that input, impact depends on the query and the application's database-account privileges and may include unauthorized data access or modification. This record covers SQL injection against an Internet-facing application (MITRE ATT&CK T1190).