<![CDATA[Website security has become one of the primary concerns in the development of information systems due to the increasing number of cyberattacks targeting web-based applications. Among various cyber threats, SQL Injection remains one of the most critical vulnerabilities because it allows attackers to manipulate Structured Query Language (SQL) statements through unsensitized user inputs, potentially resulting in unauthorized access, data leakage, data manipulation, or complete system compromise. This research aims to analyse website vulnerabilities against SQL Injection attacks using a penetration testing approach on the Damn Vulnerable Web Application (DVWA), a deliberately vulnerable web application widely utilized for cybersecurity education and security assessment. The research employed an experimental methodology consisting of reconnaissance, vulnerability identification, exploitation, and vulnerability analysis. Penetration testing was conducted using Burp Suite, browser developer tools, and manually crafted SQL Injection payloads. The testing results demonstrated that the low-security configuration of DVWA was highly susceptible to authentication bypass attacks, allowing unauthorized access to sensitive information. The analysis further revealed that the primary causes of these vulnerabilities were inadequate input validation, dynamic SQL query construction, and the absence of parameterized queries or prepared statements. This study emphasizes the importance of implementing secure coding practices, input validation, parameterized SQL queries, and Web Application Firewall (WAF) technologies to mitigate SQL Injection risks. The findings contribute to cybersecurity education by providing practical evidence of common SQL Injection vulnerabilities and effective mitigation strategies that can be adopted by software developers and information system administrators]]>
Copyrights © 2026
