The suggestGet method in the ProvisioningAction.java accepts the parameters in the request and puts them into "userDataMap".
Finally, participated in the database interaction in the executeQuery() method in H2DataSource.java.
An attacker can perform a SQL injection attack by constructing malicious parameters -- "lastanme" and "firstname".
The suggestGet method in the ProvisioningAction.java accepts the parameters in the request and puts them into "userDataMap".
Finally, participated in the database interaction in the executeQuery() method in H2DataSource.java.
An attacker can perform a SQL injection attack by constructing malicious parameters -- "lastanme" and "firstname".