Applications
Injection Attacks
Untrusted input executed as code or commands — still exploitable 25 years on.
What it is
SQL injection, command injection, LDAP injection, and NoSQL injection remain exploitable in production applications despite being well-documented since the late 1990s. Server-side template injection (SSTI) and XML injection are increasingly targeted in modern stacks. The root cause is user-controlled input being interpreted as code or structure, rather than data.
Attack techniques
- SQL Injection (T1190)
- Command Injection (T1059)
- Server-Side Template Injection (SSTI)
- NoSQL Injection
- LDAP Injection
- XML/XPath Injection
Business impact
SQL injection gives direct database access — reading, modifying, or deleting data. Command injection gives OS-level code execution on the server. Both are consistently rated critical severity.