Description
Hibernate ORM is an object-relational mapping tool for the Java programming language. It provides a framework for mapping an object-oriented domain model to a relational database. Hibernate Query Language (HQL) injection refers to an injection attack wherein an attacker tamper with the HQL query to execute malicious SQL statements that control a web application's database server.
Remediation
Use parameterized queries when dealing with HQL queries that contain user input. Parameterized queries allow the database to understand which parts of the HQL query should be considered as user input, therefore solving HQL injection.
References
Related Vulnerabilities
WordPress Plugin NOSpamPTI SQL Injection (2.1)
WordPress Plugin Chat-Support Board-WordPress Chat Multiple SQL Injection Vulnerabilities (3.3.3)
WordPress Plugin WP-Board SQL Injection (1.1)
Drupal Core 5.x SQL Injection (5.0 - 5.14)
WordPress Plugin WordPress Photo Gallery by Gallery Bank SQL Injection (3.0.229)