Issue Details
Injection
api08-2019 • Rank #8 in OWASP 2023
Explanation
API injection vulnerabilities arise when untrusted input is interpreted as executable logic in SQL, NoSQL, shell, template, or expression contexts. Attackers manipulate request fields to alter queries, execute commands, or bypass controls. Modern APIs remain vulnerable when dynamic query builders, unsafe string interpolation, or weak input contracts are used.
Remedy
Use parameterized queries and safe APIs for all data access layers. Enforce strict schema validation and normalization before business logic execution. Avoid dynamic command construction, escape output contextually, and add focused security tests for injection payloads across query, command, and template boundaries.
| Year | Rank | Category |
|---|---|---|
| 2019 | #8 | api08-2019 - Injection |