how does aem prevents sql injection? | Community
Skip to main content
This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by BrianKasingli

You should be fine, using JCR_SQL2 is read only which means that you can only use the "SELECT" keyword.

5 replies

BrianKasingli
BrianKasingliAccepted solution
New Participant
April 28, 2022

You should be fine, using JCR_SQL2 is read only which means that you can only use the "SELECT" keyword.

    maryani
    maryani
    New Participant
    March 27, 2023

    Hi 

    How can we prevent blind XPath injection for an AEM page??

     

    Thanks

     

      K
      KiranVe1
      New Participant
      April 5, 2024

      I have got a similar vulnerbility in our latest report. Did you find any solution for this?

        sourcedcode
        sourcedcode
        New Participant
        April 28, 2022

        .

          arunpatidar
          arunpatidar
          New Participant
          April 27, 2022

          Please note that JCR SQL injections != RDBMS SQL injections. SQL in JCR is strictly read-only. As far as it is possible to manipulate a query the only risk is information leakage. No data can be manipulated as is the case with RDBMSes.

           

          Arun Patidar
            Anish-Sinha
            Anish-Sinha
            Employee
            April 27, 2022

            refer this for the techniques to prevent sql injections - https://labs.tadigital.com/index.php/2018/11/05/sql-injections-overview-and-prevention-techniques/

              Bhuwan_B
              Bhuwan_B
              New Participant
              April 27, 2022

              @shikhasoni1 Please refer to below Community URL to get understanding of AEM Security Best Practices:

              https://experienceleaguecommunities.adobe.com/t5/adobe-experience-manager/aem-security-best-practices-awakening-to-the-need-for-better/td-p/449600

                Terms & ConditionsAccessibility statement

                Loading footer...