SQL Injection (OWASP #1)

Attacker injects malicious SQL into input fields. If backend concatenates without parameterization, attacker can read/modify/delete DB data. Defense: always use prepared statements, validate input, minimal DB privileges.

A 益阳 High-tech Zone enterprise customer management system was fully compromised via SQL injection - 12,000+ records stolen and sold on dark web. Root cause: one search interface without parameterized query. One line of code oversight caused irrecoverable loss.

XSS Cross-Site Scripting

Attacker injects malicious JavaScript into pages. Executes in victim browser - steals cookies, redirects to phishing sites. Stored XSS affects every visitor. Reflected XSS requires victim to click crafted link. Defense: encode output HTML entities, Content-Security-Policy header, HttpOnly cookie flag.

CSRF Cross-Site Request Forgery

Attacker tricks authenticated user into visiting malicious page that auto-requests target site using existing session. Defense: CSRF tokens on state-changing actions, secondary verification for important actions, check Referer header.

File Upload Vulnerability

If upload lacks strict validation, attacker uploads disguised webshell. Defense: whitelist allowed extensions, check magic number, upload directory must not execute scripts, rename uploaded files randomly.

DDoS

Massive requests from botnet overwhelm target. Defense: cloud DDoS protection service, CDN distribution, WAF filtering, contingency plan.