SQL_Injection issue exists @ root/basket.jsp in branch master
*The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 172 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 229 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 234 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 280 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 179 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 194 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 248 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 172 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""productid""; this input is then read by the request.getParameter method at line 154 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 187 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""productid""; this input is then read by the request.getParameter method at line 154 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 280 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""productid""; this input is then read by the request.getParameter method at line 154 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 179 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""productid""; this input is then read by the request.getParameter method at line 154 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 194 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""productid""; this input is then read by the request.getParameter method at line 154 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 280 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getParameterMap; this input is then read by the request.getParameterMap method at line 218 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 229 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getParameterMap; this input is then read by the request.getParameterMap method at line 218 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 234 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getParameterMap; this input is then read by the request.getParameterMap method at line 218 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 179 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 194 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 248 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 172 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 229 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 234 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 280 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.*
srcdevel
commented
2 years ago
SQL_Injection issue exists @ root/basket.jsp in branch master
*The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 172 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 229 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 234 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 280 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 179 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 194 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 248 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getCookies; this input is then read by the request.getCookies method at line 39 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 172 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""productid""; this input is then read by the request.getParameter method at line 154 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 187 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""productid""; this input is then read by the request.getParameter method at line 154 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 280 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""productid""; this input is then read by the request.getParameter method at line 154 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 179 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""productid""; this input is then read by the request.getParameter method at line 154 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 194 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""productid""; this input is then read by the request.getParameter method at line 154 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 280 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getParameterMap; this input is then read by the request.getParameterMap method at line 218 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 229 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getParameterMap; this input is then read by the request.getParameterMap method at line 218 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 234 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getParameterMap; this input is then read by the request.getParameterMap method at line 218 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 179 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 194 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 248 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 172 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 229 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 234 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.
The application's stmt.execute method executes an SQL query with execute, at line 280 of root\basket.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input getValue; this input is then read by the cookie.getValue method at line 44 of root\basket.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.*
Severity: High
CWE:89
Checkmarx
Training Recommended Fix
Lines: 39 218 154 44
Code (Line #39):
Code (Line #218):
Code (Line #154):
Code (Line #44):