Information Security News
mailing list archives
SQL injection flaws easy to find and exploit, Veracode report finds
From: InfoSec News <alerts () infosecnews org>
Date: Tue, 9 Apr 2013 02:19:38 -0500 (CDT)
By John E Dunn
08 April 2013
The software industry’s inability to reduce the number of security flaws
in its code is fuelling an age of the ‘everyday hacker’, criminals who
can exploit vulnerabilities with a minimum of technical skills, Security
testing firm Vercode’s latest State of Software Security (SoSS) report
(reg required) has suggested.
Of the 22,430 applications submitted to the firm’s code analysis service
in the three 18 months to June 2012, only 13 percent of web applications
were able to pass the generic OWASP Top 10 list of security problems.
When it came to standalone applications, only 31 percent complied with
the separate CWE/SANS Top 25, a significant decrease on the compliance
rate in the previous SoSS report caused, Veracode suggested, by a
broader sample of companies using the service.
Nevertheless, the percentage of applications containing common but
serious flaws such as SQL injection remained static at 32 percent, with
cross-site scripting also stubbornly entrenched at 67 percent.
Attend #HITB2013AMS April 8th - 11th in Amsterdam.
Featuring over 42 international speakers and keynotes
by Bob Lord and Edward Schwartz http://conference.hitb.org
- SQL injection flaws easy to find and exploit, Veracode report finds InfoSec News (Apr 09)