CAPEC-108
Command Line Execution through SQL Injection
An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-108: Command Line Execution through SQL Injection: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/108.html and https://cve.bz/cve/capec/108?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Probe for SQL Injection vulnerability] The attacker injects SQL syntax into user-controllable data inputs to search unfiltered execution of the SQL syntax in a query.
Exploit
They carry out the attack.
[Achieve arbitrary command execution through SQL Injection with the MSSQL_xp_cmdshell directive] The attacker leverages a SQL Injection attack to inject shell code to be executed by leveraging the xp_cmdshell directive.
[Inject malicious data in the database] Leverage SQL injection to inject data in the database that could later be used to achieve command injection if ever used as a command line argument
[Trigger command line execution with injected arguments] The attacker causes execution of command line functionality which leverages previously injected database content as arguments.
Prerequisites
The application does not properly validate data before storing in the database
Backend application implicitly trusts the data stored in the database
Malicious data is used on the backend as a command line argument
Skills required
- High skill
The attacker most likely has to be familiar with the internal functionality of the system to launch this attack. Without that knowledge, there are not many feedback mechanisms to give an attacker the indication of how to perform command injection or whether the attack is succeeding.
Resources required
None: No specialized resources are required to execute this type of attack.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Modify Data | Integrity | |
| Read Data | Confidentiality | |
| Unreliable Execution | Availability | |
| Gain Privileges | Confidentiality, Access Control, Authorization | |
| Execute Unauthorized Commands | Confidentiality, Integrity, Availability | Run Arbitrary Code |
Mitigations
Disable MSSQL xp_cmdshell directive on the database
Properly validate the data (syntactically and semantically) before writing it to the database.
Do not implicitly trust the data stored in the database. Re-validate it prior to usage to make sure that it is safe to use in a given context (e.g. as a command line argument).
Weaknesses it exploits
- CWE-20 Improper Input Validation
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
- CWE-114 Process Control
Recent CVEs with these weaknesses
- 4.9CVE-2026-105427
Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.
- 6.7CVE-2026-105426
Improper input validation in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to set arbitrary Linux kernel parameters as root.
- 7.2CVE-2026-105425
OS command injection in Ivanti Sentry before versions 10.7.4, 10.8.3, and 11.0.0 as well as in Ivanti EPMM before version 12.10.0.1, 12.9.0.3, and 12.8.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code…
- 9.6CVE-2026-108186
Improper Input Validation in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- 9.8CVE-2026-121653
SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution.
- 7.7CVE-2026-125759
Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL by supplying a crafted task group key to the orchestrator API. Attackers can send a malicious group.key to POST /v1/…
- 6.3CVE-2026-125871
The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF) vulnerability. When a user with permission to create or modify attributes of type 'link' or 'url' submits an attribute value, the…
- 7.2CVE-2026-12572
Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
- Part of
- CAPEC-66 SQL Injection
Examples
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote at…
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function (CVE-2006-6799).
Reference: https://www.cve.org/CVERecord?id=CVE-2006-6799
MITRE's words, unchanged: CAPEC-108 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.