search

jbruinaud / WebGoatNet

WebGoat .Net for demos
0 stars 0 forks source link

CX Privacy_Violation @ App_Code/DB/SqliteDbProvider.cs [master] #142

Open jbruinaud opened 4 years ago

jbruinaud commented 4 years ago

Privacy_Violation issue exists @ App_Code/DB/SqliteDbProvider.cs in branch master

Method UpdateCustomerPassword at line 259 of App_Code\DB\SqliteDbProvider.cs sends user information outside the application. This may constitute a Privacy Violation.

Severity: Medium

CWE:359

Checkmarx

Lines: 261

Code (Line #261):

            string sql = "update CustomerLogin set password = '" + Encoder.Encode(password) + "' where customerNumber = " + customerNumber;
jbruinaud commented 4 years ago

Issue still exists.

SUMMARY

Issue has total 1 vulnerabilities left to be fix (Please scroll to the top for more information)