From bleepingcomputer.com
CISA and the FBI urged executives of technology manufacturing companies to prompt formal reviews of their organizations’ software and implement mitigations to eliminate SQL injection (SQLi) security vulnerabilities before shipping.
In SQL injection attacks, threat actors “inject” maliciously crafted SQL queries into input fields or parameters used in database queries, exploiting vulnerabilities in the application’s security to execute unintended SQL commands, such as exfiltrating, manipulating, or deleting sensitive data stored in the database.
This can lead to unauthorized access to confidential data, data breaches, and even a complete takeover of the targeted systems because of improper input validation and sanitization in web applications or software that interact with the targeted databases.
CISA and the FBI advise the use of parameterized queries with prepared statements to prevent SQL injection (SQLi) vulnerabilities. This approach separates SQL code from user data, making it impossible for malicious input to be interpreted as an SQL statement.