Scan Results Example
The following is an example of the scan results showing an SQL Injection vulnerability.
An SQL_Injection vulnerability exists when user input is used in the syntax of an SQL query. Since those inputs could be interpreted as SQL syntax rather than user input, a user could manipulate the input in such a way as to alter query logic, potentially bypassing security checks and modifying the database, including the execution of system commands.
The Queries pane (bottom-left) shows that 27 instances of the SQL_Injection vulnerability were found.
Clicking ( 
) takes you to Codebashing, where you can learn more about the selected vulnerability, why it happens, and how to eliminate it.
Codebashing™
Codebashing provides in-context security training covering common vulnerability types. Click the Codebashing icon to learn more about the selected vulnerability, why it occurs, and how to remediate it. For the full list of available lessons and languages, see Codebashing.
Clicking (?) displays full general information for the SQL_Injection, including risk, cause, and recommendations with code examples.
Selecting a specific instance of the vulnerability in the Results pane (bottom, center, and right) displays the instance's code details at the top of the pane, and displays the path of component code elements in the Path pane (top-right). The Path pane shows all the code elements leading from the user input to the SQL query. Selecting each element in turn displays and highlights the element in the code context in the Source Code pane (top, left, and center). The vulnerability needs to be eliminated somewhere along that path.