SQL injection - Java SQL API
Description
Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures.
Impact
Inject SQL statements, with the possibility of obtaining information about the database, as well as extract information from it.
Recommendation
Perform queries to the database through sentences or parameterized procedures. Alternatively, use escape(String) built-in function.
Threat
Authenticated attacker from the Internet.
Expected Remediation Time
⌚ 30 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the src.
Base
- Attack vector: N
- Attack complexity: H
- Privileges required: L
- User interaction: N
- Scope: U
- Confidentiality: L
- Integrity: L
- Availability: L
Temporal
- Exploit code maturity: P
- Remediation level: X
- Report confidence: R
Result
- Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
- Score:
- Base: 5.0
- Temporal: 4.6
- Severity:
- Base: Medium
- Temporal: Medium
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: H
- Attack Requirements: N
- Privileges required: L
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): L
- Availability (VA): L
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: P
Result 4.0
- Vector string: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- Score:
- CVSS-BT: 1.3
- Severity:
- CVSS-BT: Low
Compliant code
The inputs used to performed queries are either parameterized or correctly validated
param = java.net.URLDecoder.decode(param, ""UTF-8"");
cleanParam = getCleanValue(param)
String sql = ""INSERT INTO users (username, password) VALUES ('foo','""+ cleanParam + ""')"";
try {
java.sql.Statement statement = org.owasp.benchmark.helpers.DatabaseHelper.getSqlStatement()
org.owasp.benchmark.helpers.DatabaseHelper.outputUpdateComplete(sql, response);
} catch (java.sql.SQLException e) {
...
);
Non compliant code
There are some unsanitized inputs used to perform queries
param = java.net.URLDecoder.decode(param, ""UTF-8"");
String sql = ""INSERT INTO users (username, password) VALUES ('foo','""+ param + ""')"";
try {
java.sql.Statement statement = org.owasp.benchmark.helpers.DatabaseHelper.getSqlStatement();
// Updating db model without filtering user input
org.owasp.benchmark.helpers.DatabaseHelper.outputUpdateComplete(sql, response);
} catch (java.sql.SQLException e) {
...
);
Requirements
Fixes
