CX SQL_Injection @ riches/WEB-INF/src/java/com/fortify/samples/riches/restful/AccountResources.java [master]

[kmcdon83]

SQL_Injection issue exists @ riches/WEB-INF/src/java/com/fortify/samples/riches/restful/AccountResources.java in branch master

The application's IsProfileExist method executes an SQL query with find, at line 241 of riches\WEB-INF\src\java\com\fortify\samples\riches\model\ProfileService.java. The application constructs this SQL query by embedding an untrusted string into the query without proper sanitization. The concatenated string is submitted to the database, where it is parsed and executed accordingly.
The attacker would be able to inject arbitrary data into the SQL query, by simply altering the user input representation, which is read by the AddAccount method at line 102 of riches\WEB-INF\src\java\com\fortify\samples\riches\restful\AccountResources.java. This input then flows through the code to the database server, without sanitization.
This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Internal Guidance

Checkmarx

Lines: 82 102 141 62

---

Code (Line #82):

    public String GetAccountsByName_JSON(@PathParam("username") String username) {

---

Code (Line #102):

    public String AddAccount(String representation) {

---

Code (Line #141):

    public String DeleteAccount(@PathParam("acctno") String acctno) {

---

Code (Line #62):

    public String GetAccountsByName(@PathParam("username") String username) {

---

[kmcdon83]

Issue still exists.