[f311a]

They would not catch it, it requires combining multiple vulns.

[lillesvin]

I just meant the SQLi (which is the basis of the chain), not the full chain.

[StrauXX]

There is likely thousands of such SQL concatenations throughout the codebase. The issue with traditional SAST tools is that they can't readon about context.