Code injection

This article appears to contain a large number of buzzwords. There might be a discussion about this on the talk page. Please help improve this article if you can. (September 2024)

Code injection is a class of computer security exploit in which vulnerable computer programs or system processes fail to correctly handle external data, such as user input, leading to the program misinterpreting the data as a command that should be executed. An attacker utilizing this method thereby "injects" code into the program while it is running. Successful exploitation of a code injection vulnerability can result in data breaches, access to restricted or critical computer systems, and the spread of malware.

Code injection vulnerabilities occur when an application sends untrusted data to an interpreter, which then executes the injected text as code. Injection flaws are often found in services like SQL databases, XML parsers, operating system commands, SMTP headers, and other program arguments. Injection flaws are more straightforward to discover when examining source code than when testing.^[1] Static analysis and fuzzers can help find injection flaws.^[2]

There are numerous types of code injection, but most are errors in interpretation since they treat benign user input as code or fail to distinguish input from system commands. Many examples of interpretation errors like these can exist outside of computer science, such as the comedy routine "Who's on First?". Code injection techniques are used in hacking to gain information, as well as in privilege escalation or to gain access to a system. Code injection can be used maliciously for many purposes, including:

• Arbitrarily modifying values in a database through SQL injection. The impact of this can range from website defacement to serious compromise of sensitive data.
• Installing malware or executing malevolent code on a server by injecting server scripting code (such as PHP).
• Privilege escalation to either superuser permissions on UNIX by exploiting shell injection vulnerabilities in a setuid binary, or to Local System privileges on Microsoft Windows by exploiting a service within Windows.
• Attacking web users with HTML or XSS injection.

Code injections that target the Internet of Things could also lead to severe consequences such as data breaches and service disruption.^[3]

5.66% of all vulnerabilities reported in 2008 were classified as code injection, the highest percentage on record. In 2015, this figure decreased to 0.77%.^[4]