The original post: /r/cybersecurity by /u/Advocatemack on 2024-11-13 16:05:03.
I have been doing some research into different vulnerabilities and how prevalent they are in open and closed source projects. Following the news about the MOVEit data being sold (for reference MOVEit were breached through SQL injection in 2023 but data now coming to market/ransomed) I decided to release my research of SQLi early while its being discussed.
I know how much we all dislike corporate blogs so below are the main points:
- 6.7% of all vulnerabilities found in open-source projects are SQLi
- 10% for closed-source projects!
- An increase in the total number of SQL injection in open-source projects (CVE’s that involve SQLi) from 2264 (2023) to 2400 (2024) is expected.
- As a percentage of all vulnerabilities, SQL injection is getting less popular: a decrease of 14% and 17% for open-source and closed-source projects respectively from 2023 to 2024
- Over 20% of closed source projects scanned are vulnerable to SQL injection when they first start using security tooling
- For organizations vulnerable to SQL injection, the average number of SQL injection sites is nearly 30 separate locations in the code
You can read all my findings here -> https://www.aikido.dev/blog/the-state-of-sql-injections
SQLi is a particularly interesting one as its one of the oldest vulnerabilities that we still see now and we don’t seem to be making much improvement on it despite tools, resources and a plethora of breaches reminding us of its importance.