OWASP Top 10:2021 — A03:2021 Injection¶
OWASP Foundation. (2021). OWASP Top 10:2021 — A03:2021 Injection.
Cited by¶
4 citations across 4 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Control / Data Channel Confusion
- SQL injection: a query parser conflates the query template with user input; a value like
'; DROP TABLE users; --is parsed as additional SQL.This sourceCatalogs injection vulnerabilities (SQL injection, command injection, cross-site scripting) as failures to separate the control channel from attacker-controlled data, with parameterization/structural separation as the fix.
SupportedVerified against the work's full text
OWASP A03 says injection arises when hostile data is concatenated so the SQL holds both structure and malicious data, and shows an injected value changing the query.
“Hostile data is directly used or concatenated. The SQL or command contains the structure and malicious data in dynamic queries,”
- SQL injection: a query parser conflates the query template with user input; a value like
- Data-Control Plane Breach
- Software security: SQL injection, command injection, cross-site scripting, format-string vulnerabilities, log injection — untrusted user content reaches a parser that treats it as code.
This sourceCatalogues injection vulnerabilities (SQL injection, command injection, XSS) in which untrusted user content reaches an interpreter that executes it as control, with parameterization and keeping data separate from commands as remedies.
Supported in partVerified against the work's full text
OWASP A03 supports hostile data being interpreted as SQL or OS commands and lists XSS (CWE-79), but names neither format-string nor log injection.
“Hostile data is directly used or concatenated. The SQL or command contains the structure and malicious data in dynamic queries,”
- Software security: SQL injection, command injection, cross-site scripting, format-string vulnerabilities, log injection — untrusted user content reaches a parser that treats it as code.
- Self Engagement Under Misclassification
- In cybersecurity, poorly-tuned classifiers in web-application firewalls and DDoS-mitigation systems block legitimate users or health-checks during attack response, taking down the protected service.
This sourceDocuments how poorly tuned WAF/DDoS-mitigation rules produce false positives that block legitimate traffic and health-checks, degrading the protected service.
- In cybersecurity, poorly-tuned classifiers in web-application firewalls and DDoS-mitigation systems block legitimate users or health-checks during attack response, taking down the protected service.
- Untrusted Input Execution
- In software security it is the canonical injection family: SQL injection (user input reaches a query parser that treats it as SQL), command injection (a filename reaches a shell that treats it as a second command), cross-site scripting (user content reaches an HTML parser that treats it as markup), format-string and log-injection flaws
This sourceCatalogues the injection family — SQL, command, cross-site scripting, and related flaws, plus authority-borrowing variants (SSRF, CSRF) — as untrusted input crossing into a control role and executed by a correctly-operating interpreter; documents parameterized queries as the structural fix.
Supported in partVerified against the work's full text
OWASP lists SQL, OS command and cross-site scripting among injection weaknesses and gives the interpreter-confusion mechanism; format-string and log injection are not mentioned.
“Notable Common Weakness Enumerations (CWEs) included are CWE-79: Cross-site Scripting , CWE-89: SQL Injection”
- In software security it is the canonical injection family: SQL injection (user input reaches a query parser that treats it as SQL), command injection (a filename reaches a shell that treats it as a second command), cross-site scripting (user content reaches an HTML parser that treats it as markup), format-string and log-injection flaws
Verification¶
Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.
Does it back the claim? Read against the text for 3 of 4 citations: 1 supported, 2 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Links previously used in the corpus¶
Before the registry existed this work was also linked 3 other ways.
- https://owasp.org/Top10/ ×1
- https://owasp.org/Top10/2021/ ×1
- https://owasp.org/Top10/A03_2021-Injection/ ×1
Registry ID ref:c3deabff4662 · see in the full table