The OWASP Testing Guide (more precisely: Chapter 4 therein) provides a methodology to pentest web applications. It is currently being overhauled, Version 5 is scheduled for beginning of 2018. One of the sections in the methodology is to test various weaknesses concerning input handling/validation (INPVAL). In particular, INPVAL-005 is testing for SQL injection and INPVAL-007 is testing for ORM injection. In the Summary to ORM injection it says
ORM Injection is an attack using SQL Injection against an ORM generated data access object model. From the point of view of a tester, this attack is virtually identical to a SQL Injection attack. However, the injection vulnerability exists in code generated by the ORM tool.
I wonder, is it possible to distinguish between them, i.e. is it possible to have no finding for SQLi but to have a finding for ORMi? Does it make sense at all to have two distinct testing items, or shoudln't they be merged into one?
N.B. SQL injection might also be mistaken for XPath injection - in principle
xyz' OR 'x'='x could work in both cases. However, XPath has no commenting out (so something like
xyz' or 1<2 -- does not work for XPath injection) and XPath has no
sleep function (which SQL has). So here it is possible to distinguish quite clearly. Is there a similar distinguishing feature so that one could tell ORM and SQL injection apart?