SQL Injection in DefaultResolverFactory

[scw-examples]

In src/java/com/example/acme/portal/resolver/core/DefaultResolverFactory.java on line 287, the DefaultResolverFactory class deleteResolverWithPrefix method is vulnerable to SQL injection (CWE 89) through the user controlled prefix parameter. It is possible to exploit this issue as a Contributor user through the Manage Resolvers functionality by adding a Resolver Prefix which contains a single quote (') followed by some SQL and then selecting Delete on the given resolver.

[secure-code-warrior-for-github]

Micro-Learning Topic: SQL Injection (CWE 89)

What is this? (2min video)

This is probably one of the two most exploited vulnerabilities in web applications and has led to a number of high profile company breaches. It occurs when an application fails to sanitize or validate input before using it to dynamically construct a statement. An attacker that exploits this vulnerability will be able to gain access to the underlying database and view or modify data without permission.

Examine code which interacts with relational databases and identify how each statement or query is constructed. Check if any statements are built by joining strings with external inputs and trace these data flows to see whether proper filtering or encoding was performed. Determine if special characters (such as single quotes) and keywords (such as SELECT or DROP) supplied in inputs can affect the statement that is constructed.

Try this challenge in Secure Code Warrior

Micro-Learning Topic: SQL Injection (Detected by phrase)

What is this? (2min video)

This is probably one of the two most exploited vulnerabilities in web applications and has led to a number of high profile company breaches. It occurs when an application fails to sanitize or validate input before using it to dynamically construct a statement. An attacker that exploits this vulnerability will be able to gain access to the underlying database and view or modify data without permission.

Examine code which interacts with relational databases and identify how each statement or query is constructed. Check if any statements are built by joining strings with external inputs and trace these data flows to see whether proper filtering or encoding was performed. Determine if special characters (such as single quotes) and keywords (such as SELECT or DROP) supplied in inputs can affect the statement that is constructed.

Try this challenge in Secure Code Warrior