We ran a Veracode scan on our Sitecore solution and it has identified that the
SQL injection vulnerabilities.
A full description here:
SQL injection vulnerabilities occur when data enters an application from an untrusted source and is used to dynamically construct a SQL query. This allows an attacker to manipulate database queries in order to access, modify, or delete arbitrary data. Depending on the platform, database type, and configuration, it may also be possible to execute administrative operations on the database, access the filesystem, or execute arbitrary system commands. SQL injection attacks can also be used to subvert authentication and authorization schemes, which would enable an attacker to gain privileged access to restricted portions of the application.
I'm curious if this has already been flagged and fixed with a later version of Sitecore or if it something we could be doing.