SQL Injection

SQL Injection remains the most consistently exploited vulnerability class because the underlying pattern — concatenating user input into a SQL string — is still common in new code, especially in ORMs that expose a raw query escape hatch, and in codebases that have historically mixed safe and unsafe query construction styles.

Code review misses SQLi when the user-controlled value travels several layers before reaching the query, when a framework method accepts a string argument that looks safe at the call site, or when a column name (rather than a value) is interpolated — a case that parameterized queries do not protect against. The Django JSONField vulnerability (CVE-2024-42005) is a perfect example: column aliases rather than values were injectable.

PullLight flags all SQL string construction that involves variables, checks ORM query builders for column-name interpolation (which parameterization can't fix), and traces the full data path from request input to query execution — surfacing the exact lines where the injection occurs.