[Security Concepts] Which flaw does an attacker leverage when exploiting SQL injection vulnerabilities?

SQL injection (SQLi) is an application-layer attack that exploits a vulnerability in how a web application processes user-supplied data. The fundamental flaw is the lack of proper input validation, sanitization, or the use of parameterized queries. An attacker inserts malicious SQL code into an input field (e.g., a login form or search bar). The application then incorrectly concatenates this untrusted input into a SQL query, which is executed by the database, potentially leading to unauthorized data access, modification, or deletion.

B. Linux and Windows operating systems: The vulnerability is not inherent to the operating system; it resides within the application's code that fails to handle user input securely.

C. database: The database server is merely executing the commands it receives from the application. The flaw is in the insecurely constructed query sent by the application, not the database software itself.

D. web page images: SQL injection targets data entry points that interact with a database. Web page images are typically static assets and are not a vector for this type of attack.

---

1. Cisco Press

CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide. Chapter 2

"Common Security Threats

" Section: "Injection Attacks." The text states

"The vulnerability is due to the fact that user input is either not filtered for special characters that are embedded in SQL statements or not strongly typed." This directly identifies the flaw as a failure in handling user input.

2. Cisco

"Intrusion Prevention System - SQL Injection." In the "Detailed Description" section

Cisco defines the attack: "SQL injection is a security exploit in which the attacker inserts a SQL metacharacter into a Web data input field to change the SQL query that the Web application was designed to execute." This confirms the exploit vector is the web data input field.

3. Stanford University

CS 155: Computer and Network Security

Lecture 5: "Web Security Model & SQL Injection." Slide 33 ("SQL Injection") explains the root cause: "Problem: mixing of code and data. The SQL query is code. User-provided values are data. The application mixes them." This academic source identifies the core flaw as the improper mixing of user data with SQL code

a direct result of poor input handling.