cyber.hendryadrian.com
Security Insights · aikido.dev

Why SQL Injection Still Persists Despite Decades-Old Fixes

· Original article ↗

Summary

A WordPress emergency patch highlights persistent SQL injection risks. The article examines advisory trends, unsafe framework use, AI-generated code and gaps in scanning, and discusses runtime protection and secure coding.

Key points

  • WordPress issued an emergency core update for an unauthenticated remote code execution flaw reachable through SQL injection; the article recommends versions 7.0.2 or 6.9.5.
  • The article says GitHub Advisory Database SQL injection counts rose from 2,096 in 2023 to 2,850 in 2025; 2026 figures are partial.
  • Framework protections can be bypassed when developers use raw queries or unsafe methods; Django CVE-2024-42005 is cited as an example.
  • The article cites a study in which about 40% of programs generated by GitHub Copilot were vulnerable, and an Aikido test in which about 12% of ChatGPT outputs were injectable.
  • The WordPress flaw reportedly involved a malformed batch request disrupting internal bookkeeping, allowing a value to reach the database without cleanup; the article says ordinary static analysis would not have caught it.
  • The article recommends parameterized queries and describes runtime protection as a backstop; it also promotes Aikido Zen, whose capabilities are vendor claims.

Article Details

Topic
Persistent SQL injection risks, including an emergency WordPress core vulnerability and runtime defenses.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe article describes an unauthenticated attacker exploiting a SQL injection vulnerability in WordPress core, a publicly reachable application, to achieve remote code execution.

CVE

CVE-2024-42005Django's CVE-2024-42005 is an example. Two of Django's own query methods, used to read fields out of a JSON column, dropped the field names you passed straight into the SQL without cleaning them, so an attacker who

People

Mackenzie JacksonAikido's field CTO; the article cites his scans and testing of SQL injection in code and his perspective on the role of culture, process, and education.rainforest puppyThe article says this researcher publicly wrote about SQL injection in 1998.

Products

Aikido ZenAikido Zen is an in-app firewall that runs inside your application and watches user input as it moves toward a data sink, like a database query or file read. WordPressOops! A SQL injection bug just forced an emergency WordPress core patch last week.  

Related Articles