Vulnerability fix (powered by Mobb Autofixer)

src/main/java/org/cysecurity/cspf/jvl/controller/LoginValidator.java

@@ -9,6 +9,7 @@
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.sql.Connection;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.Statement;
 import javax.servlet.ServletException;
@@ -48,8 +49,10 @@ protected void processRequest(HttpServletRequest request, HttpServletResponse re
                     if(con!=null && !con.isClosed())
                                {
                                    ResultSet rs=null;
-                                   Statement stmt = con.createStatement();  
-                                   rs=stmt.executeQuery("select * from users where username='"+user+"' and password='"+pass+"'");
+                                   PreparedStatement pstmt = con.prepareStatement("select * from users where username=? and password=?");
+                                   pstmt.setString(1, user);
+                                   pstmt.setString(2, pass);
+                                   rs=pstmt.executeQuery();
                                    if(rs != null && rs.next()){
                                    HttpSession session=request.getSession();
                                    session.setAttribute("isLoggedIn", "1");

src/main/java/org/cysecurity/cspf/jvl/controller/Register.java

@@ -55,7 +55,7 @@ protected void processRequest(HttpServletRequest request, HttpServletResponse re
                                {
 
                                    Statement stmt = con.createStatement();  
-                                  stmt.executeUpdate("INSERT into users(username, password, email, About,avatar,privilege,secretquestion,secret) values ('"+user+"','"+pass+"','"+email+"','"+about+"','default.jpg','user',1,'"+secret+"')");
+                                  stmt.executeUpdate("INSERT into users(username, password, email, About,avatar,privilege,secretquestion,secret) values ('"+user+"',"+stmt.enquoteLiteral(String.valueOf(pass))+",'"+email+"','"+about+"','default.jpg','user',1,'"+secret+"')");
                                        stmt.executeUpdate("INSERT into UserMessages(recipient, sender, subject, msg) values ('"+user+"','admin','Hi','Hi<br/> This is admin of this page. <br/> Welcome to Our Forum')");
 
                                     response.sendRedirect("index.jsp");

src/main/java/org/cysecurity/cspf/jvl/controller/sqs.java

@@ -1,5 +1,6 @@
 package messageQ;
 
+import java.sql.PreparedStatement;
 import com.amazonaws.services.sqs.AmazonSQSClientBuilder;
 import com.amazonaws.services.sqs.model.AmazonSQSException;
 import com.amazonaws.services.sqs.model.SendMessageBatchRequest;
@@ -33,8 +34,9 @@ List<Message> read(){
 	String getId(string data){
 		try{
 			Connection con=DriverManager.getConnection("jdbc:mysql://db.com:3306/core", USER, PASS);
-			Statement stmt = con.createStatement();
-			rs = stmt.executeQuery("SELECT id FROM t where data = '" + data + "'");
+			PreparedStatement stmt = con.prepareStatement("SELECT id FROM t where data = ?");
+			stmt.setString(1, data);
+			rs = stmt.executeQuery();
 			return rs.getString("Id");
 		} catch (Exception exc){
 			//

src/main/webapp/admin/manageusers.jsp

@@ -1,27 +1,33 @@
  <%@ include file="/header.jsp" %>
-  <%@page import="java.sql.Statement"%>
+<%@page import="java.sql.PreparedStatement"%>
 <%@page import="java.sql.ResultSet"%>
 <%@page import="java.sql.SQLException"%>
 <%@page import="org.cysecurity.cspf.jvl.model.DBConnect"%>
 <%@page import="java.sql.Connection"%>
 
- <%
-   Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
-    Statement stmt = con.createStatement(); 
- if(request.getParameter("delete")!=null)
- {
-     String user=request.getParameter("user");      
-     stmt.executeUpdate("Delete from users where username='"+user+"'");                      
- }
- %>	
-<form action="manageusers.jsp" method="POST">	
 <%
- ResultSet rs=stmt.executeQuery("select * from users where privilege='user'");
- while(rs.next())
- {
-     out.print("<input type='radio' name='user' value='"+rs.getString("username")+"'/> "+rs.getString("username")+"<br/>");
- }
- %>
+Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
+PreparedStatement pstmt = null;
+ResultSet rs = null;
+if(request.getParameter("delete")!=null)
+{
+    String user=request.getParameter("user");
+    String query = "Delete from users where username=?";
+    pstmt = con.prepareStatement(query);
+    pstmt.setString(1, user);
+    pstmt.executeUpdate();
+}
+%>
+<form action="manageusers.jsp" method="POST">
+<%
+String query = "select * from users where privilege='user'";
+pstmt = con.prepareStatement(query);
+rs = pstmt.executeQuery();
+while(rs.next())
+{
+    out.print("<input type='radio' name='user' value='"+rs.getString("username")+"'/> "+rs.getString("username")+"<br/>");
+}
+%>
 <br/>
 <input type="submit" value="Delete" name="delete"/>
 

src/main/webapp/changeCardDetails.jsp

@@ -21,8 +21,9 @@ if(session.getAttribute("isLoggedIn")!=null)
                 <tr><td>Expiry Date:</td><td><input type="text" name="expirydate" value=""/> </td></tr>
 		<tr><td/><td><input type="submit" name="action" value="add"/></td></tr>
                     </table>
-		</form>
-		<br/>
+		<input type="hidden" name="csrf_token" value="<%=session.getAttribute("csrf_token")%>"/>
+	</form>
+	<br/>
     <%
  Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
 
@@ -39,8 +40,12 @@ if(session.getAttribute("isLoggedIn")!=null)
         String expirydate=request.getParameter("expirydate");
         if(!cardno.equals("") && !cvv.equals("") && !expirydate.equals(""))
         {
-         Statement stmt = con.createStatement();
-         stmt.executeUpdate("INSERT into cards(id,cardno, cvv,expirydate) values ('"+id+"','"+cardno+"','"+cvv+"','"+expirydate+"')");
+         PreparedStatement pstmt = con.prepareStatement("INSERT into cards(id,cardno, cvv,expirydate) values (?,?,?,?)");
+         pstmt.setString(1, id);
+         pstmt.setString(2, cardno);
+         pstmt.setString(3, cvv);
+         pstmt.setString(4, expirydate);
+         pstmt.executeUpdate();
          out.print("<b style='color:green'> * Card details added *</b>");   
         }
         else

src/main/webapp/vulnerability/Messages.jsp

@@ -1,33 +1,29 @@
  <%@page import="java.sql.ResultSet"%>
-<%@page import="java.sql.Statement"%>
+<%@page import="java.sql.PreparedStatement"%>
 <%@page import="java.sql.Connection"%>
 <%@ include file="/header.jsp" %>
- <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%>
- <%
-      if(session.getAttribute("isLoggedIn")!=null) 
- {
-       Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
-        if(con!=null && !con.isClosed())
-          {
-             Statement stmt = con.createStatement();
-             ResultSet rs =null;
-             rs=stmt.executeQuery("select * from UserMessages where recipient='"+session.getAttribute("user")+"'");
-             out.print("</br></br>Message: </br>");
-             out.println("<ol>");
-             while (rs.next()) 
-            {
-                out.print("<li><a href='DisplayMessage.jsp?msgid="+rs.getString("msgid")+" '>"+rs.getString("subject")+"</a></li>");
-
-            }
-            out.println("</ol>");
-       }
-     out.print("<br/><br/><a href='"+path+"/myprofile.jsp?id="+session.getAttribute("userid")+"'>Return to Profile Page &gt;&gt;</a>"); 
-
- }
- else
- {
-  out.print("<span style='color:red'>* Please login to send message</span>");   
- }
-       %>
-
- <%@ include file="/footer.jsp" %>
+<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%>
+<%
+if(session.getAttribute("isLoggedIn")!=null) {
+Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
+if(con!=null && !con.isClosed()) {
+String query = "select * from UserMessages where recipient=?";
+PreparedStatement pstmt = con.prepareStatement(query);
+pstmt.setString(1, session.getAttribute("user").toString());
+ResultSet rs = pstmt.executeQuery();
+out.print("</br></br>Message: </br>");
+out.println("<ol>");
+while (rs.next()) {
+out.print("<li><a href='DisplayMessage.jsp?msgid="+rs.getString("msgid")+" '>");
+out.print(rs.getString("subject"));
+out.print("</a></li>");
+}
+out.println("</ol>");
+}
+out.print("<br/><br/><a href='"+path+"/myprofile.jsp?id="+session.getAttribute("userid")+"'>Return to Profile Page &gt;&gt;</a>");
+}
+else {
+out.print("<span style='color:red'>* Please login to send message</span>");
+}
+%>
+<%@ include file="/footer.jsp" %>

src/main/webapp/vulnerability/forumposts.jsp

@@ -1,30 +1,28 @@
  <%@page import="java.sql.ResultSet"%>
-<%@page import="java.sql.Statement"%>
+<%@page import="java.sql.PreparedStatement"%>
 <%@page import="java.sql.Connection"%>
 <%@ include file="/header.jsp" %>
- <%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%>
- <%
- Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
-
-   String postid=request.getParameter("postid");
-  if(postid!=null)
-   {
-        Statement stmt = con.createStatement();
-             ResultSet rs =null;
-             rs=stmt.executeQuery("select * from posts where postid="+postid);
-              if(rs != null && rs.next())
-              {
-                out.print("<b style='font-size:22px'>Title:"+rs.getString("title")+"</b>"); 
-                out.print("<br/>-  Posted By "+rs.getString("user")); 
-                out.print("<br/><br/>Content:<br/>"+rs.getString("content")); 
-              }
-    }
-    else
-    {
-        out.print("ID Parameter is Missing");
-    }
-
-    out.print("<br/><br/><a href='forum.jsp'>Return to Forum &gt;&gt;</a>"); 
-  %>
-
- <%@ include file="/footer.jsp" %>
+<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%>
+<%
+Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
+String postid=request.getParameter("postid");
+if(postid!=null)
+{
+PreparedStatement pstmt = con.prepareStatement("select * from posts where postid=?");
+pstmt.setString(1, postid);
+ResultSet rs =null;
+rs=pstmt.executeQuery();
+if(rs != null && rs.next())
+{
+out.print("<b style='font-size:22px'>Title:"+rs.getString("title")+"</b>");
+out.print("<br/>-  Posted By "+rs.getString("user"));
+out.print("<br/><br/>Content:<br/>"+rs.getString("content"));
+}
+}
+else
+{
+out.print("ID Parameter is Missing");
+}
+out.print("<br/><br/><a href='forum.jsp'>Return to Forum &gt;&gt;</a>");
+%>
+<%@ include file="/footer.jsp" %>

src/main/webapp/vulnerability/sqli/download_id.jsp

@@ -19,9 +19,10 @@
     if(fileid!=null && !fileid.equals(""))
    {
      Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
-            Statement stmt = con.createStatement();
+            PreparedStatement pstmt = con.prepareStatement("select * from FilesList where fileid=?");
+            pstmt.setString(1, fileid);
              ResultSet rs =null;
-             rs=stmt.executeQuery("select * from FilesList where fileid="+fileid);         
+             rs=pstmt.executeQuery();         
               if(rs != null && rs.next())
               {
 
@@ -58,6 +59,10 @@
         out.print("File Parameter is missing");
     }
   }
+  catch(SQLException e)
+  {
+       out.print("Oops, Something Went wrong");
+  }
   catch(Exception e)
   {
        out.print("Oops, Something Went wrong");