WhiteSource SAST Security Report for SQL Injection (CWE 89)

Latest Scan: 2022-03-02 07:30pm New Vulnerabilities: 1 Total Vulnerabilities: 2 Scan URL: WhiteSource SAST

Vulnerability Description

SQL Injection vulnerability occurs when a user input is used in the construction of an SQL query without proper user input string neutralization (sanitization). A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown of the DBMS), recover the content of a given file present on the DBMS file system or in some cases issue commands to the operating system

Compliance Standard Violations

PCI DSS: PCI DSS 6.5.1 - Injection Flaws
NIST: SI-10: Information Input Validation
OWASP Top 10: A1: Injection
HIPAA: 164.312 (a)(1): Standard: Access control
HITRUST: 10.b - Input Data Validation (Level 1 Implementation)
CAPEC: CAPEC-66: SQL Injection

Vulnerabilities

File	Line	Severity	Remediation Available
org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson4.java	63	Medium	❌
org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java	58	High	✅

Details

org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson4.java:63

### Snippet ```Java protected AttackResult injectableQuery(String query) { try (Connection connection = dataSource.getConnection()) { try (Statement statement = connection.createStatement(TYPE_SCROLL_INSENSITIVE, CONCUR_READ_ONLY)) { statement.executeUpdate(query); ```

Suppress Vulnerability

### Remediation Recommondations

Using prepared statements (with parameterized queries)

Correct filtering (escaping) of string literal escape characters in SQL statements, like single quote ('), double quote ("), backslash (\) and the NULL byte

Checking parameters for valid representation for the give type (integer, float or boolean)

Correct database permissions on logon, which restricts web application or user access to unnecessary data

org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java:58

### Snippet ```Java String query = "SELECT * FROM employees WHERE last_name = '" + name + "' AND auth_tan = '" + auth_tan + "'"; try (Connection connection = dataSource.getConnection()) { try { Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_UPDATABLE); log(connection, query); ResultSet results = statement.executeQuery(query); ```

Suppress Vulnerability

### Remediation Suggestion

//TODO

Create PR

Suppressed Vulnerabilities

[ ] org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallenge.java:65

NormanWenzelWSS / Webgoat-2