CX SQL_Injection @ dvwa/includes/DBMS/PGSQL.php [master]

[ghost]

SQL_Injection issue exists @ dvwa/includes/DBMS/PGSQL.php in branch master

Method <?php at line 1 of dvwa\includes\DBMS\PGSQL.php gets user input from the _SERVER element. This element’s value then flows through the code without being properly sanitized or validated, and is eventually used in a database query in method <?php at line 1 of dvwa\includes\DBMS\PGSQL.php. This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Internal Guidance

Checkmarx

Training Recommended Fix

Lines: 56

---

Code (Line #56):

$baseUrl = 'http://'.$_SERVER[ 'SERVER_NAME' ].$_SERVER[ 'PHP_SELF' ];

---

[ghost]

Issue still exists.

[ghost]

Issue still exists.

[ghost]

Issue still exists.

[ghost]

Issue still exists.