OWASP Top 10:2021 — A03:2021 Injection¶
OWASP Foundation. (2021). OWASP Top 10:2021 — A03:2021 Injection.
Cited by¶
4 citations across 4 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Control / Data Channel Confusion
- SQL injection: a query parser conflates the query template with user input; a value like
'; DROP TABLE users; --is parsed as additional SQL.This sourceCatalogs injection vulnerabilities (SQL injection, command injection, cross-site scripting) as failures to separate the control channel from attacker-controlled data, with parameterization/structural separation as the fix.
- SQL injection: a query parser conflates the query template with user input; a value like
- Data-Control Plane Breach
- Software security: SQL injection, command injection, cross-site scripting, format-string vulnerabilities, log injection — untrusted user content reaches a parser that treats it as code.
This sourceCatalogues injection vulnerabilities (SQL injection, command injection, XSS) in which untrusted user content reaches an interpreter that executes it as control, with parameterization and keeping data separate from commands as remedies.
- Software security: SQL injection, command injection, cross-site scripting, format-string vulnerabilities, log injection — untrusted user content reaches a parser that treats it as code.
- Self Engagement Under Misclassification
- In cybersecurity, poorly-tuned classifiers in web-application firewalls and DDoS-mitigation systems block legitimate users or health-checks during attack response, taking down the protected service.
This sourceDocuments how poorly tuned WAF/DDoS-mitigation rules produce false positives that block legitimate traffic and health-checks, degrading the protected service.
- In cybersecurity, poorly-tuned classifiers in web-application firewalls and DDoS-mitigation systems block legitimate users or health-checks during attack response, taking down the protected service.
- Untrusted Input Execution
- In software security it is the canonical injection family: SQL injection (user input reaches a query parser that treats it as SQL), command injection (a filename reaches a shell that treats it as a second command), cross-site scripting (user content reaches an HTML parser that treats it as markup), format-string and log-injection flaws
This sourceCatalogues the injection family — SQL, command, cross-site scripting, and related flaws, plus authority-borrowing variants (SSRF, CSRF) — as untrusted input crossing into a control role and executed by a correctly-operating interpreter; documents parameterized queries as the structural fix.
- In software security it is the canonical injection family: SQL injection (user input reaches a query parser that treats it as SQL), command injection (a filename reaches a shell that treats it as a second command), cross-site scripting (user content reaches an HTML parser that treats it as markup), format-string and log-injection flaws
Verification¶
This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.
Links previously used in the corpus¶
Before the registry existed this work was also linked 3 other ways.
- https://owasp.org/Top10/ ×1
- https://owasp.org/Top10/2021/ ×1
- https://owasp.org/Top10/A03_2021-Injection/ ×1
Registry ID ref:c3deabff4662 · see in the full table