CX Blind_SQL_Injections @ src/main/webapp/vulnerability/csrf/change-info.jsp [master]

[satyamchaurasiapersistent]

Blind_SQL_Injections issue exists @ src/main/webapp/vulnerability/csrf/change-info.jsp in branch master

The application's stmt.executeUpdate method executes an SQL query with executeUpdate, at line 31 of src\main\webapp\vulnerability\csrf\change-info.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly. If an exception is thrown by the database code, it is caught and handled. An attacker could still use inferential or boolean exploitation techniques to retrieve the data, by altering the user input ""info"". This is read in the info=request.getParameter method, at line 26 of src\main\webapp\vulnerability\csrf\change-info.jsp, and used without sanitization in the SQL query that is sent to the database server.  This may enable a Blind SQL Injection attack.

Severity: Low

CWE:89

Vulnerability details and guidance

Checkmarx

Training Recommended Fix

Lines: 26

---

Code (Line #26):

   String info=request.getParameter("info");

---

[satyamchaurasiapersistent]

Issue still exists.

[satyamchaurasiapersistent]

Issue still exists.

[satyamchaurasiapersistent]

Issue still exists.

[satyamchaurasiapersistent]

Issue still exists.