CX SQL_Injection @ app/src/main/java/jakhar/aseem/diva/InsecureDataStorage2Activity.java [master] #1
Description
SQL_Injection issue exists @ app/src/main/java/jakhar/aseem/diva/InsecureDataStorage2Activity.java in branch master
Method saveCredentials at line 63 of app\src\main\java\jakhar\aseem\diva\InsecureDataStorage2Activity.java gets user input from the getText element. This element’s value then flows through the code without being properly sanitized or validated, and is eventually used in a database query in method saveCredentials at line 63 of app\src\main\java\jakhar\aseem\diva\InsecureDataStorage2Activity.java. This may enable an SQL Injection attack.
Severity: High
CWE:89
Vulnerability details and guidance
Internal Guidance
Lines: 67
mDB.execSQL("INSERT INTO myuser VALUES ('"+ usr.getText().toString() +"', '"+ pwd.getText().toString() +"');");