Anthropic-Cybersecurity-Skills/skills/performing-second-order-sql-injection/references/api-reference.md

Second-Order SQL Injection - API Reference

Attack Overview

Second-order SQL injection occurs when user-supplied data is stored in a database and later incorporated into SQL queries without sanitization. Unlike first-order SQLi, the injection payload is not executed at the point of input but at a secondary execution point.

Attack Flow:

1. Attacker submits payload via input form (e.g., username registration)
2. Application safely stores the payload in database (parameterized INSERT)
3. Application later retrieves the stored value
4. Stored value is concatenated into a new SQL query without sanitization
5. Injection executes at the secondary query point

SQL Injection Patterns

Pattern	Example	Risk
UNION SELECT	' UNION SELECT password FROM users--	Data exfiltration
Tautology	' OR 1=1--	Authentication bypass
Stacked queries	'; DROP TABLE users--	Data destruction
Time-based blind	'; WAITFOR DELAY '0:0:5'--	Data extraction
Error-based	' AND CONVERT(int, @@version)--	Information disclosure

Code Sink Patterns (Vulnerable Code)

Python (dangerous)

cursor.execute(f"SELECT * FROM orders WHERE user='{username}'")
cursor.execute("SELECT * FROM orders WHERE user='%s'" % username)

Python (safe - parameterized)

cursor.execute("SELECT * FROM orders WHERE user=%s", (username,))

PHP (dangerous)

$query = "SELECT * FROM orders WHERE user='" . $username . "'";

Database Dump Format

The agent expects JSON format for database analysis:

{
  "users": [
    {"id": 1, "username": "admin", "email": "admin@example.com"},
    {"id": 2, "username": "' UNION SELECT 1,2,3--", "email": "test@test.com"}
  ],
  "comments": [
    {"id": 1, "body": "Normal comment"},
    {"id": 2, "body": "'; DROP TABLE users--"}
  ]
}

Data Flow Tracing

The agent correlates stored payloads with code sinks by matching table/column names referenced in source code queries against tables containing injection payloads.

Prevention

• Use parameterized queries (prepared statements) everywhere
• Apply output encoding when using stored data in queries
• Implement stored procedure-based data access
• Use an ORM that auto-parameterizes queries
• Validate data on both input AND retrieval from database

Output Schema

{
  "report": "second_order_sql_injection",
  "total_findings": 15,
  "stored_payloads": 5,
  "code_sinks": 8,
  "confirmed_attack_paths": 2,
  "findings": [{"type": "confirmed_attack_path", "severity": "critical"}]
}

CLI Usage

python agent.py --db-dump database.json --source /app/src --output report.json