Hibernate Query Language (HQL) Injection

Description

Hibernate ORM is an object-relational mapping tool for the Java programming language. It provides a framework for mapping an object-oriented domain model to a relational database. Hibernate Query Language (HQL) injection refers to an injection attack wherein an attacker tamper with the HQL query to execute malicious SQL statements that control a web application's database server.

Remediation

Use parameterized queries when dealing with HQL queries that contain user input. Parameterized queries allow the database to understand which parts of the HQL query should be considered as user input, therefore solving HQL injection.