SQL injection (second order)
Summary: PortSwigger Research describes second-order SQL injection, where user-supplied data is stored by the application and later incorporated into SQL queries in an unsafe way, so detection normally requires submitting data in one location and then using another application function that processes it unsafely. The page states that SQL injection can let an attacker read or modify critical application data, interfere with application logic, escalate privileges within the database, and take control of the database server, and that parameterized queries are the most effective prevention.
Bottom line: Second-order injection defeats the common assumption that input is safe because it was validated on the way in - the payload sits in your database until some other function picks it up, and the consequence the source names is an attacker taking control of the database server.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026