# GO-SEC-001: SQL Injection via database/sql

> **Severity:** CRITICAL | **CWE:** CWE-89 | **OWASP:** A03:2021

- **Language:** Go
- **Category:** Security
- **URL:** https://codepathfinder.dev/registry/golang/security/GO-SEC-001
- **Detection:** `pathfinder scan --ruleset golang/GO-SEC-001 --project .`

## Description

SQL injection occurs when user-controlled input is concatenated into a SQL query string
instead of being passed as a parameterized argument. Go's database/sql package provides
safe parameterized queries using placeholder syntax ($1/$2 for PostgreSQL, ? for MySQL
and SQLite, @name for named parameters). When developers instead use string concatenation,
the database driver interprets user-supplied content as SQL syntax.

**Attack mechanics**: An attacker sends crafted input that closes the current SQL context
and injects new SQL statements. For example, in `"SELECT * FROM users WHERE id = " + id`,
the attacker provides `1 OR 1=1` to return all rows, or `1; DROP TABLE users; --` on
databases that support stacked queries.

**Real-world impact in Go ecosystem**:
- "**CVE-2024-35181** (Meshery, CVSS 8.8): SQL injection via parameter manipulation"
  in the meshery/meshery API, allowing authenticated attackers to read arbitrary data
  from the database.
- "**CVE-2024-35182** (Meshery, CVSS 8.8): Companion vulnerability in the same codebase."
- "**CVE-2024-37896** (gin-vue-admin, CVSS 9.8): SQL injection via unsanitized query"
  parameters in GORM-based queries in the gin-vue-admin administrative framework.

**OWASP testing**: SQL injection is consistently the most frequently tested vulnerability
class in penetration tests. The OWASP Go Testing Guide documents Go-specific patterns
including ORM-level injections that bypass naive pattern matching.

This rule tracks taint flow from HTTP request sources (net/http, gin, echo, fiber, chi,
gorilla/mux) to database/sql sink methods (Query, Exec, QueryRow, and their Context
variants). The sanitized_by list includes strconv conversion functions that confirm the
value was parsed as a number (making SQL injection impossible for numeric inputs).


## Vulnerable Code

```python
# --- file: vulnerable.go ---
// GO-SEC-001 positive test cases — all SHOULD be detected
package main

import (
	"database/sql"
	"net/http"

	"github.com/gin-gonic/gin"
)

func sqlInjectionQuery(w http.ResponseWriter, r *http.Request) {
	db, _ := sql.Open("postgres", "")
	id := r.FormValue("id")                                   // source
	db.Query("SELECT * FROM users WHERE id = " + id)         // SINK: SQL injection
}

func sqlInjectionExec(w http.ResponseWriter, r *http.Request) {
	db, _ := sql.Open("postgres", "")
	name := r.FormValue("name")                               // source
	db.Exec("DELETE FROM users WHERE name = '" + name + "'") // SINK
}

func sqlInjectionQueryRow(db *sql.DB, c *gin.Context) {
	id := c.Param("id")                                       // source: Gin URL param
	db.QueryRow("SELECT * FROM items WHERE id = " + id)      // SINK
}

func sqlInjectionQueryContext(db *sql.DB, r *http.Request) {
	filter := r.FormValue("filter")
	db.QueryContext(nil, "SELECT * FROM logs WHERE "+filter)  // SINK
}

# --- file: go.mod ---
module example.com/go-sec-001/positive

go 1.25.0

require github.com/gin-gonic/gin v1.12.0

require (
	github.com/bytedance/gopkg v0.1.3 // indirect
	github.com/bytedance/sonic v1.15.0 // indirect
	github.com/bytedance/sonic/loader v0.5.0 // indirect
	github.com/cloudwego/base64x v0.1.6 // indirect
	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
	github.com/gin-contrib/sse v1.1.0 // indirect
	github.com/go-playground/locales v0.14.1 // indirect
	github.com/go-playground/universal-translator v0.18.1 // indirect
	github.com/go-playground/validator/v10 v10.30.1 // indirect
	github.com/goccy/go-json v0.10.5 // indirect
	github.com/goccy/go-yaml v1.19.2 // indirect
	github.com/json-iterator/go v1.1.12 // indirect
	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
	github.com/leodido/go-urn v1.4.0 // indirect
	github.com/mattn/go-isatty v0.0.20 // indirect
	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
	github.com/modern-go/reflect2 v1.0.2 // indirect
	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
	github.com/quic-go/qpack v0.6.0 // indirect
	github.com/quic-go/quic-go v0.59.0 // indirect
	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
	github.com/ugorji/go/codec v1.3.1 // indirect
	go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
	golang.org/x/arch v0.22.0 // indirect
	golang.org/x/crypto v0.48.0 // indirect
	golang.org/x/net v0.51.0 // indirect
	golang.org/x/sys v0.41.0 // indirect
	golang.org/x/text v0.34.0 // indirect
	google.golang.org/protobuf v1.36.10 // indirect
)

# --- file: go.sum ---
github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
github.com/bytedance/sonic v1.15.0 h1:/PXeWFaR5ElNcVE84U0dOHjiMHQOwNIx3K4ymzh/uSE=
github.com/bytedance/sonic v1.15.0/go.mod h1:tFkWrPz0/CUCLEF4ri4UkHekCIcdnkqXw9VduqpJh0k=
github.com/bytedance/sonic/loader v0.5.0 h1:gXH3KVnatgY7loH5/TkeVyXPfESoqSBSBEiDd5VjlgE=
github.com/bytedance/sonic/loader v0.5.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
golang.org/x/arch v0.22.0 h1:c/Zle32i5ttqRXjdLyyHZESLD/bB90DCU1g9l/0YBDI=
golang.org/x/arch v0.22.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
```

## Secure Code

```python
// SECURE: parameterized query ($1 placeholder for PostgreSQL)
func getUserByID(db *sql.DB, r *http.Request) {
    id := r.FormValue("id")
    row := db.QueryRow("SELECT name FROM users WHERE id = $1", id)
    var name string
    row.Scan(&name)
}

// SECURE: multiple parameters with context
func searchUsers(db *sql.DB, r *http.Request) {
    name := r.FormValue("name")
    active := r.FormValue("active")
    ctx := r.Context()
    rows, err := db.QueryContext(ctx,
        "SELECT id, name FROM users WHERE name = $1 AND active = $2",
        name, active)
    if err != nil {
        // handle error
    }
    defer rows.Close()
}

// SECURE: numeric ID validated before use (strconv acts as sanitizer)
func getProduct(db *sql.DB, c *gin.Context) {
    productID, err := strconv.Atoi(c.Param("id"))
    if err != nil {
        c.JSON(400, gin.H{"error": "invalid id"})
        return
    }
    row := db.QueryRow("SELECT * FROM products WHERE id = $1", productID)
    // ...
}

// SECURE: dynamic ORDER BY via allowlist (cannot be parameterized in SQL)
func listUsers(db *sql.DB, r *http.Request) {
    sortCol := r.FormValue("sort")
    allowed := map[string]bool{"name": true, "created_at": true, "email": true}
    if !allowed[sortCol] {
        sortCol = "created_at"
    }
    rows, _ := db.Query("SELECT * FROM users ORDER BY " + sortCol + " DESC")
    defer rows.Close()
}

```

## Detection Rule (Python SDK)

```python
"""GO-SEC-001: SQL injection via database/sql (standard library)."""

from codepathfinder.go_rule import (
    GoGinContext,
    GoHTTPRequest,
    GoSQLDB,
    GoEchoContext,
    GoFiberCtx,
    GoStrconv,
    QueryType,
)
from codepathfinder import flows
from codepathfinder.presets import PropagationPresets
from codepathfinder.go_decorators import go_rule


class GoChiRouter(QueryType):
    fqns = ["github.com/go-chi/chi/v5"]
    patterns = ["chi.*"]
    match_subclasses = False


class GoGorillaMux(QueryType):
    fqns = ["github.com/gorilla/mux"]
    patterns = ["mux.*"]
    match_subclasses = False


@go_rule(
    id="GO-SEC-001",
    severity="CRITICAL",
    cwe="CWE-89",
    owasp="A03:2021",
    tags="go,security,sql-injection,database,CWE-89,OWASP-A03",
    message=(
        "User-controlled input flows into a database/sql query method (Query, Exec, QueryRow). "
        "This creates a SQL injection vulnerability — attackers can modify the SQL statement "
        "to bypass authentication, exfiltrate data, or destroy the database. "
        "Use parameterized queries: db.Query('SELECT * FROM users WHERE id = $1', userID)"
    ),
)
def go_sql_injection():
    """HTTP request input reaches database/sql query methods — SQL injection."""
    return flows(
        from_sources=[
            GoGinContext.method(
                "Param", "Query", "PostForm", "GetRawData",
                "ShouldBindJSON", "BindJSON", "GetHeader"
            ),
            GoEchoContext.method("QueryParam", "FormValue", "Param", "PathParam"),
            GoFiberCtx.method("Params", "Query", "FormValue", "Get"),
            GoHTTPRequest.method("FormValue", "PostFormValue", "UserAgent"),
            GoHTTPRequest.attr("Body", "URL.Path", "URL.RawQuery"),
            GoChiRouter.method("URLParam"),
            GoGorillaMux.method("Vars"),
        ],
        to_sinks=[
            GoSQLDB.method(
                "Query", "Exec", "QueryRow",
                "QueryContext", "ExecContext", "QueryRowContext",
                "Prepare", "PrepareContext",
            ),
        ],
        sanitized_by=[
            GoStrconv.method("Atoi", "ParseInt", "ParseFloat", "ParseUint"),
        ],
        propagates_through=PropagationPresets.standard(),
        scope="global",
    )
```

## How to Fix

- Always use parameterized queries: db.Query("... WHERE id = $1", id) not string concat.
- For MySQL/SQLite, use ? placeholder; for PostgreSQL, use $1/$2; for SQL Server, use @p1.
- Use strconv.Atoi or strconv.ParseInt to validate numeric IDs before use (also sanitizes).
- For dynamic ORDER BY columns, validate against an explicit string allowlist.
- Use an ORM like GORM with named parameters for complex queries — see GO-GORM-SQLI rules.
- Apply least-privilege database accounts: read-only accounts cannot DROP TABLE.
- Enable query logging in staging environments to detect unparameterized queries.

## Security Implications

- **Authentication Bypass:** Injecting ` OR '1'='1` into a login query bypasses credential checks, granting access
to any account. Injecting ` OR '1'='1' LIMIT 1` targets the first user (often admin).

- **Full Database Exfiltration:** UNION SELECT attacks dump tables not intended for the current query.
INFORMATION_SCHEMA allows discovering all table and column names, enabling systematic
extraction of the entire database contents.

- **Data Destruction:** On databases that support stacked queries (SQL Server, PostgreSQL with some drivers),
injected DROP TABLE or DELETE statements destroy production data.

- **Out-of-Band Data Exfiltration:** Blind SQL injection via time delays (SLEEP(), pg_sleep()) or DNS callbacks
(xp_dirtree on SQL Server, LOAD_FILE on MySQL) allows data extraction without
visible query results.

- **Privilege Escalation:** Stored procedures with higher privileges (xp_cmdshell on SQL Server) can be invoked
through injection, enabling operating system command execution from a database query.


## References

- [CWE-89: SQL Injection — MITRE](https://cwe.mitre.org/data/definitions/89.html)
- [Go database/sql package documentation](https://pkg.go.dev/database/sql)
- [Go database/sql tutorial — The Go Wiki](https://go.dev/doc/database/)
- [Avoiding SQL injection — Go database documentation](https://go.dev/doc/database/sql-injection)
- [OWASP SQL Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)
- [OWASP Testing Guide: Testing for SQL Injection (v4.2)](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection)
- [CVE-2024-35181 — Meshery SQL injection (GitHub Advisory)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35181)
- [CVE-2024-37896 — gin-vue-admin SQL injection (GitHub Advisory)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37896)

---

Source: https://codepathfinder.dev/registry/golang/security/GO-SEC-001
Code Pathfinder — Open source, type-aware SAST with cross-file dataflow analysis