CX SQL_Injection @ src/main/webapp/ForgotPassword.jsp [master] #33
Description
SQL_Injection issue exists @ src/main/webapp/ForgotPassword.jsp in branch master
*The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 42 of src\main\webapp\ForgotPassword.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""secret""; this input is then read by the stmt.executeQuery method at line 42 of src\main\webapp\ForgotPassword.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.Similarity ID: 197463578
The application's stmt.executeQuery method executes an SQL query with executeQuery, at line 42 of src\main\webapp\ForgotPassword.jsp. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.An attacker would be able to inject arbitrary syntax and data into the SQL query, by crafting a malicious payload and providing it via the input ""username""; this input is then read by the stmt.executeQuery method at line 42 of src\main\webapp\ForgotPassword.jsp. This input then flows through the code, into a query and to the database server - without sanitization.This may enable an SQL Injection attack.Similarity ID: 1232499164*
Similarity Id: 197463578, 1232499164
Severity: CRITICAL
CWE:89
Lines: 42
rs=stmt.executeQuery("select * from users where username='"+request.getParameter("username").trim()+"' and secret='"+request.getParameter("secret")+"'");