Week 9: Audit 15 Code Snippets for SQL Injection

SQL Injection Audit Challenge: Can You Spot the Bug? Difficulty: Intermediate Skills: SQL Injection, Secure Coding, Python, sqlite3, SQLAlchemy, psycopg2 Time: 60–90 minutes The Breach That Should Never Have Happened It is 2:47 AM on a Tuesday when the DBA at a mid-sized SaaS company notices something wrong. Query latency has spiked. Rows in the users table are being read at a rate no legitimate application traffic could explain. By 3:15 AM the forensics team confirms what everyone feared: 4.2 million user records — usernames, emails, and bcrypt password hashes — are gone. Exfiltrated through the company's own API. The root cause? A single Python function. A developer had written: query = " SELECT id, email FROM users WHERE username = '" + username + "'" cursor . execute ( query ) One string concatenation. One missing parameterized query. That was all it took for an attacker to craft a payload that turned a routine user lookup into a full database dump. The attack took eleven minutes.