Skip to content

Code Security Report: 36 high severity findings, 47 total findings [master] #44

Open
Open
Code Security Report: 36 high severity findings, 47 total findings [master]#44
Labels
Mend: code security findingsCode security findings detected by Mend

Description

@mend-for-github-com
mend-for-github-com
bot
opened on Jul 31, 2025

Code Security Report

Scan Metadata

Latest Scan: 2025-10-20 08:59am
Total Findings: 47 | New Findings: 0 | Resolved Findings: 0
Tested Project Files: 60
Detected Programming Languages: 1 (Java*)

  • Check this box to manually trigger a scan

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Most Relevant Findings

The list below presents the 10 most relevant findings that need your attention. To view information on the remaining findings, navigate to the Mend Application.

Automatic Remediation Available (10)

SeverityVulnerability TypeCWEFileData FlowsDetected
HighSQL Injection

CWE-89

DisplayMessage.jsp:16

12025-06-08 07:44am
Vulnerable Code

JavaVulnerableLab/src/main/webapp/vulnerability/DisplayMessage.jsp

Lines 11 to 16 in b216e03

{
if(request.getParameter("msgid")!=null)
{
Statement stmt = con.createStatement();
ResultSet rs =null;
rs=stmt.executeQuery("select * from UserMessages where msgid="+request.getParameter("msgid"));

1 Data Flow/s detected

JavaVulnerableLab/src/main/webapp/vulnerability/DisplayMessage.jsp

Line 16 in b216e03

rs=stmt.executeQuery("select * from UserMessages where msgid="+request.getParameter("msgid"));

Remediation Suggestion

JavaVulnerableLab/diffs/b2a50b0e-8ce2-440f-8a18-7bb564e7fe0c/DisplayMessage.jsp.diff

Lines 1 to 49 in 94dd526

<%@page import="java.sql.ResultSet"%>
<%@page import="java.sql.Statement"%>
<%@page import="java.sql.Connection"%>
<%@ include file="/header.jsp" %>
<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%>
<%
if(session.getAttribute("isLoggedIn")!=null)
{
Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
if(con!=null && !con.isClosed())
{
if(request.getParameter("msgid")!=null)
{
- Statement stmt = con.createStatement();
- ResultSet rs =null;
- rs=stmt.executeQuery("select * from UserMessages where msgid="+request.getParameter("msgid"));
+ PreparedStatement stmt = con.prepareStatement("select * from UserMessages where msgid=?");
+ stmt.setString(1, request.getParameter("msgid"));
+ ResultSet rs = stmt.executeQuery();
if(rs.next())
{
out.print("<b>Sender:</b> "+rs.getString("sender"));
out.print("<br/><b>Subject:</b>"+rs.getString("subject"));
out.print("<br/><b>Message:</b> <br/>"+rs.getString("msg"));
}
else
{
out.print("No Message Found");
}
}
else
{
out.print("Message Id Parameter is missing");
}
out.print("<br/><br/><a href='"+path+"/vulnerability/Messages.jsp'>Return to Messages &gt;&gt;</a>");
out.print("<br/><br/><a href='"+path+"/myprofile.jsp?id="+session.getAttribute("userid")+"'>Return to Profile Page &gt;&gt;</a>");
}
}
else
{
out.print("<span style='color:red'>* Please login to send message</span>");
}
%>
<%@ include file="/footer.jsp" %>

  • Create pull request into master

Remediation feedback:

  • 👍 Like
  • 👎 Dislike

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior SQL Injection Training

● Videos

   ▪ Secure Code Warrior SQL Injection Video

● Further Reading

   ▪ OWASP SQL Injection Prevention Cheat Sheet

   ▪ OWASP SQL Injection

   ▪ OWASP Query Parameterization Cheat Sheet

❌ Finding suppression was rejected with comment: test

 
HighSQL Injection

CWE-89

ForgotPassword.jsp:42

12025-06-08 07:44am
Vulnerable Code

JavaVulnerableLab/src/main/webapp/ForgotPassword.jsp

Lines 37 to 42 in b216e03

if(request.getParameter("secret")!=null)
{
Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
ResultSet rs=null;
Statement stmt = con.createStatement();
rs=stmt.executeQuery("select * from users where username='"+request.getParameter("username").trim()+"' and secret='"+request.getParameter("secret")+"'");

1 Data Flow/s detected

JavaVulnerableLab/src/main/webapp/ForgotPassword.jsp

Line 42 in b216e03

rs=stmt.executeQuery("select * from users where username='"+request.getParameter("username").trim()+"' and secret='"+request.getParameter("secret")+"'");

Remediation Suggestion

JavaVulnerableLab/diffs/ea9e8b0f-9a4e-421f-aee1-85b25b0ac4a5/ForgotPassword.jsp.diff

Lines 1 to 59 in c719f55

<%@page import="org.cysecurity.cspf.jvl.model.DBConnect"%>
<%@page import="java.sql.Statement"%>
<%@page import="java.sql.ResultSet"%>
<%@page import="java.sql.Connection"%>
<%@ include file="header.jsp" %>
<script type="text/javascript">
$(document).ready(function(){
$("#username").change(function(){
var username = $(this).val();
$.getJSON("UsernameCheck.do","username="+username,function(result)
{
if(result.available==1)
{
$("#status").html("<b style='color:green'>&#10004;</b>");
}
else
{
$("#status").html("<b style='color:red'>&#10006; username doesn't exist</b>");
}
});
});
});
</script>
Password Recovery:
<form action="iframe.php?url=https%3A%2F%2Fgithub.com%2FForgotPassword.jsp" method="post">
<table>
<tr><td>Username: </td><td><input type="text" name="username" id="username"/></td><td><span id="status"></span></td></tr>
<tr><td>What's Your Pet's name?: </td><td><input type="text" name="secret" /></td></tr>
<tr><td><input type="submit" name="GetPassword" value="GetPassword"/></td></tr>
</table>
</form><br/>
<%
if(request.getParameter("secret")!=null)
{
Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
ResultSet rs=null;
- Statement stmt = con.createStatement();
- rs=stmt.executeQuery("select * from users where username='"+request.getParameter("username").trim()+"' and secret='"+request.getParameter("secret")+"'");
+ String sql = "select * from users where username=? and secret=?";
+ PreparedStatement stmt = con.prepareStatement(sql);
+ stmt.setString(1, request.getParameter("username").trim());
+ stmt.setString(2, request.getParameter("secret"));
+ rs = stmt.executeQuery();
if(rs != null && rs.next()){
out.print("Hello "+rs.getString("username")+", <b class='success'> Your Password is: "+rs.getString("password"));
}
else
{
out.print("<b class='fail'> Secret/Email is wrong</b>");
}
}
%>
<%@ include file="footer.jsp" %>

  • Create pull request into master

Remediation feedback:

  • 👍 Like
  • 👎 Dislike

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior SQL Injection Training

● Videos

   ▪ Secure Code Warrior SQL Injection Video

● Further Reading

   ▪ OWASP SQL Injection Prevention Cheat Sheet

   ▪ OWASP SQL Injection

   ▪ OWASP Query Parameterization Cheat Sheet

❌ Finding suppression was rejected with comment: Dangerous

 
HighSQL Injection

CWE-89

forum.jsp:48

32025-06-08 07:44am
Vulnerable Code

JavaVulnerableLab/src/main/webapp/vulnerability/forum.jsp

Lines 43 to 48 in b216e03

String title=request.getParameter("title");
if(con!=null && !con.isClosed())
{
Statement stmt = con.createStatement();
//Posting Content
stmt.executeUpdate("INSERT into posts(content,title,user) values ('"+content+"','"+title+"','"+user+"')");

3 Data Flow/s detected
View Data Flow 1

JavaVulnerableLab/src/main/webapp/vulnerability/forum.jsp

Line 41 in b216e03

String user=request.getParameter("user");

JavaVulnerableLab/src/main/webapp/vulnerability/forum.jsp

Line 48 in b216e03

stmt.executeUpdate("INSERT into posts(content,title,user) values ('"+content+"','"+title+"','"+user+"')");

View Data Flow 2

JavaVulnerableLab/src/main/webapp/vulnerability/forum.jsp

Line 42 in b216e03

String content=request.getParameter("content");

JavaVulnerableLab/src/main/webapp/vulnerability/forum.jsp

Line 48 in b216e03

stmt.executeUpdate("INSERT into posts(content,title,user) values ('"+content+"','"+title+"','"+user+"')");

View Data Flow 3

JavaVulnerableLab/src/main/webapp/vulnerability/forum.jsp

Line 43 in b216e03

String title=request.getParameter("title");

JavaVulnerableLab/src/main/webapp/vulnerability/forum.jsp

Line 48 in b216e03

stmt.executeUpdate("INSERT into posts(content,title,user) values ('"+content+"','"+title+"','"+user+"')");

Remediation Suggestion

JavaVulnerableLab/diffs/7fe2f408-995d-45f3-bd41-6662a816b84c/forum.jsp.diff

Lines 1 to 88 in 6a7ed39

<%--
Document : forum
Created on : 1 Dec, 2014, 3:22:09 PM
Author : breakthesec
--%>
<%@page import="java.sql.Connection"%>
<%@page import="java.sql.Statement"%>
<%@page import="java.sql.SQLException"%>
<%@page import="java.sql.ResultSetMetaData"%>
<%@page import="java.sql.ResultSet"%>
<%@ page import="java.util.*,java.io.*"%>
<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%>
<%@page contentType="text/html" pageEncoding="UTF-8"%>
<%@ include file="/header.jsp" %>
<%
Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
if(session.getAttribute("isLoggedIn")!=null && session.getAttribute("isLoggedIn").equals("1"))
{
out.print("Hello "+session.getAttribute("user")+", Welcome to Our Forum !");
}
%>
<br/> <br/>
<h3>Create Post:</h3>
<form action="iframe.php?url=https%3A%2F%2Fgithub.com%2Fforum.jsp" method="POST">
Title : <input type="text" name="title" value="" size="50"/><br/>
Message: <br/><textarea name="content" rows="2" cols="50"></textarea>
<input type="hidden" name="user" value="<% if(session.getAttribute("user")!=null){out.print(session.getAttribute("user"));} else { out.print("Anonymous"); } %>" size="50"/><br/>
<input type="submit" value="Post" name="post"/>
</form>
<br/>
<%
if(request.getParameter("post")!=null)
{
String user=request.getParameter("user");
String content=request.getParameter("content");
String title=request.getParameter("title");
if(con!=null && !con.isClosed())
{
- Statement stmt = con.createStatement();
- //Posting Content
- stmt.executeUpdate("INSERT into posts(content,title,user) values ('"+content+"','"+title+"','"+user+"')");
+ String sql = "INSERT into posts(content,title,user) values (?,?,?)";
+ PreparedStatement stmt = con.prepareStatement(sql);
+ stmt.setString(1, content);
+ stmt.setString(2, title);
+ stmt.setString(3, user);
+ stmt.executeUpdate();
out.print("Successfully posted");
}
}
%>
<h3>List of Posts:</h3>
<%
if(con!=null && !con.isClosed())
{
Statement stmt = con.createStatement();
ResultSet rs =null;
rs=stmt.executeQuery("select * from posts");
out.println("<table border='1'>");
while (rs.next())
{
out.print("<tr>");
out.print("<td><a href="iframe.php?url=https%3A%2F%2Fgithub.com%2Fforumposts.jsp%3Fpostid%3D"+rs.getString("postid")+"'>"+rs.getString("title")+"</a></td>");
out.print("<td> - Posted By ");
if(!rs.getString("user").equalsIgnoreCase("anonymous"))
{
out.print("<a href="iframe.php?url=https%3A%2F%2Fgithub.com%2FUserDetails.jsp%3Fusername%3D"+rs.getString("user")+"'>"+rs.getString("user")+"</a>");
}
else
{
out.print(rs.getString("user"));
}
out.println("</td></tr>");
}
out.println("</table>");
}
out.print("<br/> <a href="iframe.php?url=https%3A%2F%2Fgithub.com%2FforumUsersList.jsp">Forum Users list &gt;&gt;</a>");
%>
<%@ include file="/footer.jsp" %>

  • Create pull request into master

Remediation feedback:

  • 👍 Like
  • 👎 Dislike

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior SQL Injection Training

● Videos

   ▪ Secure Code Warrior SQL Injection Video

● Further Reading

   ▪ OWASP SQL Injection Prevention Cheat Sheet

   ▪ OWASP SQL Injection

   ▪ OWASP Query Parameterization Cheat Sheet

Request Suppression
  • ... as False Alarm
  • ... as Acceptable Risk

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

 
HighSQL Injection

CWE-89

Install.java:117

12025-06-08 07:44am
Vulnerable Code

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java

Lines 112 to 117 in b216e03

Connection con= DriverManager.getConnection(dburl,dbuser,dbpass);
if(con!=null && !con.isClosed())
{
//Database creation
Statement stmt = con.createStatement();
stmt.executeUpdate("DROP DATABASE IF EXISTS "+dbname);

1 Data Flow/s detected

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java

Line 58 in b216e03

dbname = request.getParameter("dbname");

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java

Line 87 in b216e03

if(setup(i))

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java

Line 103 in b216e03

protected boolean setup(String i) throws IOException

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java

Line 117 in b216e03

stmt.executeUpdate("DROP DATABASE IF EXISTS "+dbname);

Remediation Suggestion

JavaVulnerableLab/diffs/45380e4a-bf3e-4b9c-9e13-73c3a0ecb5c3/Install.java.diff

Lines 1 to 233 in 8faf59c

package org.cysecurity.cspf.jvl.controller;
/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
+import java.sql.PreparedStatement;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.PrintWriter;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.Properties;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.cysecurity.cspf.jvl.model.HashMe;
/**
*
* @author breakthesec
*/
public class Install extends HttpServlet {
static String dburl;
static String jdbcdriver;
static String dbuser;
static String dbpass;
static String dbname;
static String siteTitle;
static String adminuser;
static String adminpass;
/**
* Processes requests for both HTTP <code>GET</code> and <code>POST</code>
* methods.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
String configPath=getServletContext().getRealPath("/WEB-INF/config.properties");
//Getting Database Configuration from User Input
dburl = request.getParameter("dburl");
jdbcdriver = request.getParameter("jdbcdriver");
dbuser = request.getParameter("dbuser");
dbpass = request.getParameter("dbpass");
dbname = request.getParameter("dbname");
siteTitle= request.getParameter("siteTitle");
adminuser= request.getParameter("adminuser");
adminpass= HashMe.hashMe(request.getParameter("adminpass"));
//Moifying Configuration Properties:
Properties config=new Properties();
config.load(new FileInputStream(configPath));
config.setProperty("dburl",dburl);
config.setProperty("jdbcdriver",jdbcdriver);
config.setProperty("dbuser",dbuser);
config.setProperty("dbpass",dbpass);
config.setProperty("dbname",dbname);
config.setProperty("siteTitle",siteTitle);
FileOutputStream fileout = new FileOutputStream(configPath);
config.store(fileout, null);
fileout.close();
String i=request.getParameter("setup");
response.setContentType("text/html;charset=UTF-8");
try {
PrintWriter out = response.getWriter();
/* TODO output your page here. You may use following sample code. */
out.println("<!DOCTYPE html>");
out.println("<html>");
out.println("<head>");
out.println("<title>Servlet install</title>");
out.println("</head>");
out.println("<body>");
if(setup(i))
{
out.print("successfully installed");
}
else
{
out.print("Something went wrong. Unable to install");
}
out.println("</body>");
out.println("</html>");
}
catch(Exception e)
{
}
}
protected boolean setup(String i) throws IOException
{
if(i.equals("1"))
{
try
{
Class.forName(jdbcdriver);
Connection con= DriverManager.getConnection(dburl,dbuser,dbpass);
if(con!=null && !con.isClosed())
{
//Database creation
- Statement stmt = con.createStatement();
- stmt.executeUpdate("DROP DATABASE IF EXISTS "+dbname);
-
- stmt.executeUpdate("CREATE DATABASE "+dbname);
+ PreparedStatement stmt = con.prepareStatement("DROP DATABASE IF EXISTS ?");
+ stmt.setString(1, dbname);
+ stmt.executeUpdate();
+ stmt = con.prepareStatement("CREATE DATABASE ?");
+ stmt.setString(1, dbname);
+ stmt.executeUpdate();
con.close();
con= DriverManager.getConnection(dburl+dbname,dbuser,dbpass);
stmt = con.createStatement();
if(!con.isClosed())
{
//User Table creation
stmt.executeUpdate("Create table users(ID int NOT NULL AUTO_INCREMENT, username varchar(30),email varchar(60), password varchar(60), about varchar(50),privilege varchar(20),avatar TEXT,secretquestion int,secret varchar(30),primary key (id))");
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('"+adminuser+"','"+adminpass+"','admin@localhost','I am the admin of this application','default.jpg','admin',1,'rocky')");
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('victim','victim','victim@localhost','I am the victim of this application','default.jpg','user',1,'max')");
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('attacker','attacker','attacker@localhost','I am the attacker of this application','default.jpg','user',1,'bella')");
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('NEO','trinity','neo@matrix','I am the NEO','default.jpg','user',1,'sentinel')");
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('trinity','NEO','trinity@matrix','it is Trinity','default.jpg','user',1,'sentinel')");
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('Anderson','java','anderson@1999','I am computer programmer','default.jpg','user',1,'C++')");
//Posts table creation
stmt.executeUpdate("create table posts(postid int NOT NULL AUTO_INCREMENT, content TEXT,title varchar(100), user varchar(30), primary key (postid))");
stmt.executeUpdate("INSERT into posts(content,title, user) values ('Feel free to ask any questions about Java Vulnerable Lab','First Post', 'admin')");
stmt.executeUpdate("INSERT into posts(content,title, user) values ('Hello Guys, this is victim','Second Post', 'victim')");
stmt.executeUpdate("INSERT into posts(content,title, user) values ('Hello This is attacker','Third Post', 'attacker')");
stmt.executeUpdate("INSERT into posts(content,title, user) values ('Trinity! Help!','Help','neo')");
stmt.executeUpdate("create table tdata(id int, page varchar(30))");
stmt.executeUpdate("Insert into tdata values(1,'ext1.html')");
stmt.executeUpdate("Insert into tdata values(2,'ext2.html')");
//Messages Table Creation
stmt.executeUpdate("Create table Messages(msgid int NOT NULL AUTO_INCREMENT,name varchar(30),email varchar(60), msg varchar(500),primary key (msgid))");
stmt.executeUpdate("INSERT into Messages(name,email, msg) values ('TestUser','Test@localhost', 'Hi admin, how are you')");
//User Messages Table Creation recipient, sender, email, msg
stmt.executeUpdate("Create table UserMessages(msgid int NOT NULL AUTO_INCREMENT,recipient varchar(30),sender varchar(30),subject varchar(60), msg varchar(500),primary key (msgid))");
stmt.executeUpdate("INSERT into UserMessages(recipient, sender, subject, msg) values ('attacker','admin','Hi','Hi<br/> This is admin of this page. <br/> Welcome to Our Forum')");
stmt.executeUpdate("INSERT into UserMessages(recipient, sender, subject, msg) values ('victim','admin','Hi','Hi<br/> This is admin of this page. <br/> Welcome to Our Forum')");
//Credit Card Table Creation
stmt.executeUpdate("Create table cards(id int,cardno varchar(80), cvv varchar(6),expirydate varchar(15))");
stmt.executeUpdate("INSERT into cards(id,cardno, cvv,expirydate) values ('1','4000123456789010','123','12/2014')");
stmt.executeUpdate("INSERT into cards(id,cardno, cvv,expirydate) values ('2','4111111111111111 ','321','7/2015')");
stmt.executeUpdate("INSERT into cards(id,cardno, cvv,expirydate) values ('3','5111111111111118','111','1/2017')");
//Files List Table Creation
stmt.executeUpdate("Create table FilesList(fileid int NOT NULL AUTO_INCREMENT,path text,primary key (fileid))");
stmt.executeUpdate("INSERT into FilesList(path) values ('/docs/doc1.pdf')");
stmt.executeUpdate("INSERT into FilesList(path) values ('/docs/exampledoc.pdf')");
return true;
}
return false;
}
}
catch(SQLException ex)
{
System.out.println("SQLException: " + ex.getMessage());
System.out.println("SQLState: " + ex.getSQLState());
System.out.println("VendorError: " + ex.getErrorCode());
}
catch(ClassNotFoundException ex)
{
System.out.print("JDBC Driver Missing:<br/>"+ex);
}
}
return false;
}
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
/**
* Handles the HTTP <code>GET</code> method.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
@Override
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
}
/**
* Handles the HTTP <code>POST</code> method.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
}
/**
* Returns a short description of the servlet.
*
* @return a String containing servlet description
*/
@Override
public String getServletInfo() {
return "Short description";
}// </editor-fold>
}

  • Create pull request into master

Remediation feedback:

  • 👍 Like
  • 👎 Dislike

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior SQL Injection Training

● Videos

   ▪ Secure Code Warrior SQL Injection Video

● Further Reading

   ▪ OWASP SQL Injection Prevention Cheat Sheet

   ▪ OWASP SQL Injection

   ▪ OWASP Query Parameterization Cheat Sheet

Request Suppression
  • ... as False Alarm
  • ... as Acceptable Risk

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

 
HighCross-Site Scripting

CWE-79

SendMessage.jsp:18

22025-06-08 07:44am
Vulnerable Code

JavaVulnerableLab/src/main/webapp/vulnerability/SendMessage.jsp

Lines 13 to 18 in b216e03

%>
<br/><br/>
<form action="../SendMessage.do" method="POST">
<table>
<tr><td>Recipient: </td><td><input type="text" name="recipient" value="<% if(request.getParameter("recipient")!=null){ out.print(request.getParameter("recipient")); } %>"/></td></tr>

2 Data Flow/s detected
View Data Flow 1

JavaVulnerableLab/src/main/webapp/vulnerability/SendMessage.jsp

Line 18 in b216e03

<tr><td>Recipient: </td><td><input type="text" name="recipient" value="<% if(request.getParameter("recipient")!=null){ out.print(request.getParameter("recipient")); } %>"/></td></tr>

View Data Flow 2

JavaVulnerableLab/src/main/webapp/vulnerability/SendMessage.jsp

Line 18 in b216e03

<tr><td>Recipient: </td><td><input type="text" name="recipient" value="<% if(request.getParameter("recipient")!=null){ out.print(request.getParameter("recipient")); } %>"/></td></tr>

Remediation Suggestion

JavaVulnerableLab/diffs/233d90e7-951f-431a-b941-8edbf753689d/SendMessage.jsp.diff

Lines 1 to 36 in c2ad21a

+<%@ page import="org.apache.commons.text.StringEscapeUtils" %>
<%@page import="java.sql.ResultSet"%>
<%@page import="java.sql.Statement"%>
<%@page import="java.sql.Connection"%>
<%@ include file="/header.jsp" %>
<%@ page import="org.cysecurity.cspf.jvl.model.DBConnect"%>
<%
if(session.getAttribute("isLoggedIn")!=null)
{
if(request.getParameter("status")!=null)
{
out.print(request.getParameter("status")); //Displaying any error message
}
%>
<br/><br/>
<form action="iframe.php?url=https%3A%2F%2Fgithub.com%2F..%2FSendMessage.do" method="POST">
<table>
-<tr><td>Recipient: </td><td><input type="text" name="recipient" value="<% if(request.getParameter("recipient")!=null){ out.print(request.getParameter("recipient")); } %>"/></td></tr>
+<tr><td>Recipient: </td><td><input type="text" name="recipient" value="<% if(request.getParameter("recipient")!=null){ out.print(StringEscapeUtils.escapeHtml4(request.getParameter("recipient"))); } %>"/></td></tr>
<tr><td>Subject :</td><td><input type="text" name="subject"/></td></tr>
<tr><td>Message :</td><td><textarea name="msg"></textarea></td></tr>
<tr> <td><input type="hidden" name="sender" value="<%=session.getAttribute("user")%>"/></td></tr>
<tr><td><input type="submit" name="send" value="send"/></td></tr>
</table>
</form>
<%
}
else
{
out.print("<span style='color:red'>* Please login to send message</span>");
}
%>
<%@ include file="/footer.jsp" %>

  • Create pull request into master

Remediation feedback:

  • 👍 Like
  • 👎 Dislike

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Cross-Site Scripting Training

● Videos

   ▪ Secure Code Warrior Cross-Site Scripting Video

Request Suppression
  • ... as False Alarm
  • ... as Acceptable Risk

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

 
HighCross-Site Scripting

CWE-79

xss4.jsp:15

22025-06-08 07:44am
Vulnerable Code

JavaVulnerableLab/src/main/webapp/vulnerability/xss/xss4.jsp

Lines 10 to 15 in b216e03

<%
if (keyword != null)
{
%>
Search Results for <%=keyword%>

2 Data Flow/s detected
View Data Flow 1

JavaVulnerableLab/src/main/webapp/vulnerability/xss/xss4.jsp

Line 2 in b216e03

<% String keyword = request.getParameter("keyword"); %>

View Data Flow 2

JavaVulnerableLab/src/main/webapp/vulnerability/xss/xss4.jsp

Line 2 in b216e03

<% String keyword = request.getParameter("keyword"); %>

Remediation Suggestion

JavaVulnerableLab/diffs/081b32c7-d51b-4a89-9419-d6efc065e8a8/xss4.jsp.diff

Lines 1 to 29 in c2ad21a

+<%@ page import="org.apache.commons.text.StringEscapeUtils" %>
<%@ include file="/header.jsp" %>
- <% String keyword = request.getParameter("keyword"); %>
+<% String keyword = request.getParameter("keyword"); %>
+<% if (keyword != null) { keyword = StringEscapeUtils.escapeHtml4(keyword); } %>
<h1>[incomplete]</h1>
Please enter only words and search:<br/><br/>
<form action="iframe.php?url=https%3A%2F%2Fgithub.com%2Fxss4.jsp" method="get">
- <input type="text" name="keyword" value=<% if (keyword != null){ out.print(keyword);} %>>
+<input type="text" name="keyword" value="<%= keyword %>">
<br/><br/><input type="submit" name="Search" value="Search"/>
</form>
<br/>
<%
if (keyword != null)
{
%>
- Search Results for <%=keyword%>
+Search Results for <%= keyword %>
<%
}
%>
<br/>
<br/>
<br/>
<br/>
<%@ include file="/footer.jsp" %>

  • Create pull request into master

Remediation feedback:

  • 👍 Like
  • 👎 Dislike

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Cross-Site Scripting Training

● Videos

   ▪ Secure Code Warrior Cross-Site Scripting Video

Request Suppression
  • ... as False Alarm
  • ... as Acceptable Risk

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

 
HighSQL Injection

CWE-89

orm.jsp:11

12025-06-08 07:44am
Vulnerable Code

JavaVulnerableLab/src/main/webapp/vulnerability/Injection/orm.jsp

Lines 6 to 11 in b216e03

<%@page import="org.hibernate.Query"%>
<%@page import="org.hibernate.Session"%>
<%@ include file="/header.jsp" %>
<%!
private static String queryUsers(Session session,String id) {
Query query = session.createQuery("from Users where id="+id);

1 Data Flow/s detected

JavaVulnerableLab/src/main/webapp/vulnerability/Injection/orm.jsp

Line 50 in b216e03

out.print(queryUsers(ormSession,request.getParameter("id")));

JavaVulnerableLab/src/main/webapp/vulnerability/Injection/orm.jsp

Line 10 in b216e03

private static String queryUsers(Session session,String id) {

JavaVulnerableLab/src/main/webapp/vulnerability/Injection/orm.jsp

Line 11 in b216e03

Query query = session.createQuery("from Users where id="+id);

Remediation Suggestion

JavaVulnerableLab/diffs/08b2f57a-fe9f-49df-96c3-f09e8df46846/orm.jsp.diff

Lines 1 to 62 in 437da4c

<%@page import="org.hibernate.cfg.Configuration"%>
<%@page import="org.hibernate.SessionFactory"%>
<%@page import="java.util.List"%>
<%@page import="org.cysecurity.cspf.jvl.model.orm.Users"%>
<%@page import="org.hibernate.Query"%>
<%@page import="org.hibernate.Session"%>
<%@ include file="/header.jsp" %>
<%!
private static String queryUsers(Session session,String id) {
- Query query = session.createQuery("from Users where id="+id);
+ Query query = session.createQuery("from Users where id = :id");
+ query.setParameter("id", id);
List <Users>list = query.list();
java.util.Iterator<Users> iter = list.iterator();
String results="Details:<br/>---------------<br/>";
if (iter.hasNext()) {
Users users = iter.next();
results+= "Name: " + users.getUsername() +"<br/> About: " + users.getAbout();
}
session.getTransaction().commit();
return results;
}
%>
<%
try{
//Reading config from properties file:
String dbuser=properties.getProperty("dbuser");
String dbpass = properties.getProperty("dbpass");
String dbfullurl = properties.getProperty("dburl")+properties.getProperty("dbname");
String jdbcdriver = properties.getProperty("jdbcdriver");
Configuration configuration = new Configuration();
configuration.setProperty( "hibernate.connection.driver_class",jdbcdriver);
configuration.setProperty( "hibernate.connection.url",dbfullurl);
configuration.setProperty( "hibernate.connection.username", dbuser);
configuration.setProperty( "hibernate.connection.password", dbpass);
configuration.setProperty( "hibernate.dialect","org.hibernate.dialect.MySQLDialect");
configuration.addResource("Users.hbm.xml");
SessionFactory factory;
factory=configuration.buildSessionFactory();
Session ormSession = factory.openSession();
ormSession.beginTransaction();
out.print(queryUsers(ormSession,request.getParameter("id")));
}
catch(Exception e)
{
out.print(e);
}
%>
<%@ include file="/footer.jsp" %>

  • Create pull request into master

Remediation feedback:

  • 👍 Like
  • 👎 Dislike

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior SQL Injection Training

● Videos

   ▪ Secure Code Warrior SQL Injection Video

● Further Reading

   ▪ OWASP SQL Injection Prevention Cheat Sheet

   ▪ OWASP SQL Injection

   ▪ OWASP Query Parameterization Cheat Sheet

Request Suppression
  • ... as False Alarm
  • ... as Acceptable Risk

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

 
HighSQL Injection

CWE-89

Register.java:58

52025-06-08 07:44am
Vulnerable Code

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java

Lines 53 to 58 in b216e03

{
if(con!=null && !con.isClosed())
{
Statement stmt = con.createStatement();
stmt.executeUpdate("INSERT into users(username, password, email, About,avatar,privilege,secretquestion,secret) values ('"+user+"','"+pass+"','"+email+"','"+about+"','default.jpg','user',1,'"+secret+"')");

5 Data Flow/s detected
View Data Flow 1

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java

Line 44 in b216e03

String pass=request.getParameter("password");

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java

Line 58 in b216e03

stmt.executeUpdate("INSERT into users(username, password, email, About,avatar,privilege,secretquestion,secret) values ('"+user+"','"+pass+"','"+email+"','"+about+"','default.jpg','user',1,'"+secret+"')");

View Data Flow 2

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java

Line 43 in b216e03

String user=request.getParameter("username");

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java

Line 58 in b216e03

stmt.executeUpdate("INSERT into users(username, password, email, About,avatar,privilege,secretquestion,secret) values ('"+user+"','"+pass+"','"+email+"','"+about+"','default.jpg','user',1,'"+secret+"')");

View Data Flow 3

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java

Line 45 in b216e03

String email=request.getParameter("email");

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Register.java

Line 58 in b216e03

stmt.executeUpdate("INSERT into users(username, password, email, About,avatar,privilege,secretquestion,secret) values ('"+user+"','"+pass+"','"+email+"','"+about+"','default.jpg','user',1,'"+secret+"')");

View more Data Flows

Remediation Suggestion

JavaVulnerableLab/diffs/5c5c3f9a-9f7a-47a7-868f-e8697e4f8f21/Register.java.diff

Lines 1 to 132 in c65bcd0

/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
package org.cysecurity.cspf.jvl.controller;
+import java.sql.PreparedStatement;
import java.io.IOException;
import java.io.PrintWriter;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.cysecurity.cspf.jvl.model.DBConnect;
/**
*
* @author breakthesec
*/
public class Register extends HttpServlet {
/**
* Processes requests for both HTTP <code>GET</code> and <code>POST</code>
* methods.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
response.setContentType("text/html;charset=UTF-8");
try {
PrintWriter out = response.getWriter();
Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
String user=request.getParameter("username");
String pass=request.getParameter("password");
String email=request.getParameter("email");
String about=request.getParameter("About");
String secret=request.getParameter("secret");
if(secret==null || secret.equals(""))
{
secret="nosecret";
}
try
{
if(con!=null && !con.isClosed())
{
- Statement stmt = con.createStatement();
- stmt.executeUpdate("INSERT into users(username, password, email, About,avatar,privilege,secretquestion,secret) values ('"+user+"','"+pass+"','"+email+"','"+about+"','default.jpg','user',1,'"+secret+"')");
+ String sql = "INSERT into users(username, password, email, About, avatar, privilege, secretquestion, secret) values (?, ?, ?, ?, 'default.jpg', 'user', 1, ?)";
+ PreparedStatement stmt = con.prepareStatement(sql);
+ stmt.setString(1, user);
+ stmt.setString(2, pass);
+ stmt.setString(3, email);
+ stmt.setString(4, about);
+ stmt.setString(5, secret);
+ stmt.executeUpdate();
stmt.executeUpdate("INSERT into UserMessages(recipient, sender, subject, msg) values ('"+user+"','admin','Hi','Hi<br/> This is admin of this page. <br/> Welcome to Our Forum')");
response.sendRedirect("index.jsp");
}
else
{
response.sendRedirect("Register.jsp");
}
}
catch(SQLException ex)
{
System.out.println("SQLException: " + ex.getMessage());
System.out.println("SQLState: " + ex.getSQLState());
System.out.println("VendorError: " + ex.getErrorCode());
}
}
catch(Exception e)
{
}
}
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
/**
* Handles the HTTP <code>GET</code> method.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
@Override
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
}
/**
* Handles the HTTP <code>POST</code> method.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
}
/**
* Returns a short description of the servlet.
*
* @return a String containing servlet description
*/
@Override
public String getServletInfo() {
return "Short description";
}// </editor-fold>
}

  • Create pull request into master

Remediation feedback:

  • 👍 Like
  • 👎 Dislike

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior SQL Injection Training

● Videos

   ▪ Secure Code Warrior SQL Injection Video

● Further Reading

   ▪ OWASP SQL Injection Prevention Cheat Sheet

   ▪ OWASP SQL Injection

   ▪ OWASP Query Parameterization Cheat Sheet

Request Suppression
  • ... as False Alarm
  • ... as Acceptable Risk

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

 
HighSQL Injection

CWE-89

UsernameCheck.java:48

12025-06-08 07:44am
Vulnerable Code

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java

Lines 43 to 48 in b216e03

JSONObject json=new JSONObject();
if(con!=null && !con.isClosed())
{
ResultSet rs=null;
Statement stmt = con.createStatement();
rs=stmt.executeQuery("select * from users where username='"+user+"'");

1 Data Flow/s detected

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java

Line 42 in b216e03

String user=request.getParameter("username").trim();

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/UsernameCheck.java

Line 48 in b216e03

rs=stmt.executeQuery("select * from users where username='"+user+"'");

Remediation Suggestion

JavaVulnerableLab/diffs/cdbc1da9-f0af-4d08-89a8-85b0f38eb77a/UsernameCheck.java.diff

Lines 1 to 112 in c65bcd0

/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
package org.cysecurity.cspf.jvl.controller;
+import java.sql.PreparedStatement;
import java.io.IOException;
import java.io.PrintWriter;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.Statement;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.cysecurity.cspf.jvl.model.DBConnect;
import org.json.JSONObject;
/**
*
* @author breakthesec
*/
public class UsernameCheck extends HttpServlet {
/**
* Processes requests for both HTTP <code>GET</code> and <code>POST</code>
* methods.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
response.setContentType("application/json");
PrintWriter out = response.getWriter();
try {
Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));
String user=request.getParameter("username").trim();
JSONObject json=new JSONObject();
if(con!=null && !con.isClosed())
{
ResultSet rs=null;
- Statement stmt = con.createStatement();
- rs=stmt.executeQuery("select * from users where username='"+user+"'");
+ PreparedStatement stmt = con.prepareStatement("select * from users where username=?");
+ stmt.setString(1, user);
+ ResultSet rs = stmt.executeQuery();
if (rs.next())
{
json.put("available", "1");
}
else
{
json.put("available", new Integer(0));
}
}
out.print(json);
}
catch(Exception e)
{
out.print(e);
}
finally {
out.close();
}
}
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
/**
* Handles the HTTP <code>GET</code> method.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
@Override
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
}
/**
* Handles the HTTP <code>POST</code> method.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
}
/**
* Returns a short description of the servlet.
*
* @return a String containing servlet description
*/
@Override
public String getServletInfo() {
return "Short description";
}// </editor-fold>
}

  • Create pull request into master

Remediation feedback:

  • 👍 Like
  • 👎 Dislike

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior SQL Injection Training

● Videos

   ▪ Secure Code Warrior SQL Injection Video

● Further Reading

   ▪ OWASP SQL Injection Prevention Cheat Sheet

   ▪ OWASP SQL Injection

   ▪ OWASP Query Parameterization Cheat Sheet

Request Suppression
  • ... as False Alarm
  • ... as Acceptable Risk

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

 
HighSQL Injection

CWE-89

Install.java:127

12025-06-08 07:44am
Vulnerable Code

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java

Lines 122 to 127 in b216e03

stmt = con.createStatement();
if(!con.isClosed())
{
//User Table creation
stmt.executeUpdate("Create table users(ID int NOT NULL AUTO_INCREMENT, username varchar(30),email varchar(60), password varchar(60), about varchar(50),privilege varchar(20),avatar TEXT,secretquestion int,secret varchar(30),primary key (id))");
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('"+adminuser+"','"+adminpass+"','admin@localhost','I am the admin of this application','default.jpg','admin',1,'rocky')");

1 Data Flow/s detected

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java

Line 60 in b216e03

adminuser= request.getParameter("adminuser");

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java

Line 87 in b216e03

if(setup(i))

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java

Line 103 in b216e03

protected boolean setup(String i) throws IOException

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Install.java

Line 127 in b216e03

stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('"+adminuser+"','"+adminpass+"','admin@localhost','I am the admin of this application','default.jpg','admin',1,'rocky')");

Remediation Suggestion

JavaVulnerableLab/diffs/c42bf95c-4ab6-4f1b-b132-4baf7fb6d1cf/Install.java.diff

Lines 1 to 232 in 714b40b

package org.cysecurity.cspf.jvl.controller;
/*
* To change this license header, choose License Headers in Project Properties.
* To change this template file, choose Tools | Templates
* and open the template in the editor.
*/
+import java.sql.PreparedStatement;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.PrintWriter;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.Properties;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.cysecurity.cspf.jvl.model.HashMe;
/**
*
* @author breakthesec
*/
public class Install extends HttpServlet {
static String dburl;
static String jdbcdriver;
static String dbuser;
static String dbpass;
static String dbname;
static String siteTitle;
static String adminuser;
static String adminpass;
/**
* Processes requests for both HTTP <code>GET</code> and <code>POST</code>
* methods.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
String configPath=getServletContext().getRealPath("/WEB-INF/config.properties");
//Getting Database Configuration from User Input
dburl = request.getParameter("dburl");
jdbcdriver = request.getParameter("jdbcdriver");
dbuser = request.getParameter("dbuser");
dbpass = request.getParameter("dbpass");
dbname = request.getParameter("dbname");
siteTitle= request.getParameter("siteTitle");
adminuser= request.getParameter("adminuser");
adminpass= HashMe.hashMe(request.getParameter("adminpass"));
//Moifying Configuration Properties:
Properties config=new Properties();
config.load(new FileInputStream(configPath));
config.setProperty("dburl",dburl);
config.setProperty("jdbcdriver",jdbcdriver);
config.setProperty("dbuser",dbuser);
config.setProperty("dbpass",dbpass);
config.setProperty("dbname",dbname);
config.setProperty("siteTitle",siteTitle);
FileOutputStream fileout = new FileOutputStream(configPath);
config.store(fileout, null);
fileout.close();
String i=request.getParameter("setup");
response.setContentType("text/html;charset=UTF-8");
try {
PrintWriter out = response.getWriter();
/* TODO output your page here. You may use following sample code. */
out.println("<!DOCTYPE html>");
out.println("<html>");
out.println("<head>");
out.println("<title>Servlet install</title>");
out.println("</head>");
out.println("<body>");
if(setup(i))
{
out.print("successfully installed");
}
else
{
out.print("Something went wrong. Unable to install");
}
out.println("</body>");
out.println("</html>");
}
catch(Exception e)
{
}
}
protected boolean setup(String i) throws IOException
{
if(i.equals("1"))
{
try
{
Class.forName(jdbcdriver);
Connection con= DriverManager.getConnection(dburl,dbuser,dbpass);
if(con!=null && !con.isClosed())
{
//Database creation
Statement stmt = con.createStatement();
stmt.executeUpdate("DROP DATABASE IF EXISTS "+dbname);
stmt.executeUpdate("CREATE DATABASE "+dbname);
con.close();
con= DriverManager.getConnection(dburl+dbname,dbuser,dbpass);
stmt = con.createStatement();
if(!con.isClosed())
{
//User Table creation
stmt.executeUpdate("Create table users(ID int NOT NULL AUTO_INCREMENT, username varchar(30),email varchar(60), password varchar(60), about varchar(50),privilege varchar(20),avatar TEXT,secretquestion int,secret varchar(30),primary key (id))");
- stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('"+adminuser+"','"+adminpass+"','admin@localhost','I am the admin of this application','default.jpg','admin',1,'rocky')");
+stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values (?, ?, 'admin@localhost', 'I am the admin of this application', 'default.jpg', 'admin', 1, 'rocky')");
+PreparedStatement pstmt = con.prepareStatement(sql);
+pstmt.setString(1, adminuser);
+pstmt.setString(2, adminpass);
+pstmt.executeUpdate();
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('victim','victim','victim@localhost','I am the victim of this application','default.jpg','user',1,'max')");
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('attacker','attacker','attacker@localhost','I am the attacker of this application','default.jpg','user',1,'bella')");
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('NEO','trinity','neo@matrix','I am the NEO','default.jpg','user',1,'sentinel')");
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('trinity','NEO','trinity@matrix','it is Trinity','default.jpg','user',1,'sentinel')");
stmt.executeUpdate("INSERT into users(username, password, email,About,avatar, privilege,secretquestion,secret) values ('Anderson','java','anderson@1999','I am computer programmer','default.jpg','user',1,'C++')");
//Posts table creation
stmt.executeUpdate("create table posts(postid int NOT NULL AUTO_INCREMENT, content TEXT,title varchar(100), user varchar(30), primary key (postid))");
stmt.executeUpdate("INSERT into posts(content,title, user) values ('Feel free to ask any questions about Java Vulnerable Lab','First Post', 'admin')");
stmt.executeUpdate("INSERT into posts(content,title, user) values ('Hello Guys, this is victim','Second Post', 'victim')");
stmt.executeUpdate("INSERT into posts(content,title, user) values ('Hello This is attacker','Third Post', 'attacker')");
stmt.executeUpdate("INSERT into posts(content,title, user) values ('Trinity! Help!','Help','neo')");
stmt.executeUpdate("create table tdata(id int, page varchar(30))");
stmt.executeUpdate("Insert into tdata values(1,'ext1.html')");
stmt.executeUpdate("Insert into tdata values(2,'ext2.html')");
//Messages Table Creation
stmt.executeUpdate("Create table Messages(msgid int NOT NULL AUTO_INCREMENT,name varchar(30),email varchar(60), msg varchar(500),primary key (msgid))");
stmt.executeUpdate("INSERT into Messages(name,email, msg) values ('TestUser','Test@localhost', 'Hi admin, how are you')");
//User Messages Table Creation recipient, sender, email, msg
stmt.executeUpdate("Create table UserMessages(msgid int NOT NULL AUTO_INCREMENT,recipient varchar(30),sender varchar(30),subject varchar(60), msg varchar(500),primary key (msgid))");
stmt.executeUpdate("INSERT into UserMessages(recipient, sender, subject, msg) values ('attacker','admin','Hi','Hi<br/> This is admin of this page. <br/> Welcome to Our Forum')");
stmt.executeUpdate("INSERT into UserMessages(recipient, sender, subject, msg) values ('victim','admin','Hi','Hi<br/> This is admin of this page. <br/> Welcome to Our Forum')");
//Credit Card Table Creation
stmt.executeUpdate("Create table cards(id int,cardno varchar(80), cvv varchar(6),expirydate varchar(15))");
stmt.executeUpdate("INSERT into cards(id,cardno, cvv,expirydate) values ('1','4000123456789010','123','12/2014')");
stmt.executeUpdate("INSERT into cards(id,cardno, cvv,expirydate) values ('2','4111111111111111 ','321','7/2015')");
stmt.executeUpdate("INSERT into cards(id,cardno, cvv,expirydate) values ('3','5111111111111118','111','1/2017')");
//Files List Table Creation
stmt.executeUpdate("Create table FilesList(fileid int NOT NULL AUTO_INCREMENT,path text,primary key (fileid))");
stmt.executeUpdate("INSERT into FilesList(path) values ('/docs/doc1.pdf')");
stmt.executeUpdate("INSERT into FilesList(path) values ('/docs/exampledoc.pdf')");
return true;
}
return false;
}
}
catch(SQLException ex)
{
System.out.println("SQLException: " + ex.getMessage());
System.out.println("SQLState: " + ex.getSQLState());
System.out.println("VendorError: " + ex.getErrorCode());
}
catch(ClassNotFoundException ex)
{
System.out.print("JDBC Driver Missing:<br/>"+ex);
}
}
return false;
}
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
/**
* Handles the HTTP <code>GET</code> method.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
@Override
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
}
/**
* Handles the HTTP <code>POST</code> method.
*
* @param request servlet request
* @param response servlet response
* @throws ServletException if a servlet-specific error occurs
* @throws IOException if an I/O error occurs
*/
@Override
protected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
processRequest(request, response);
}
/**
* Returns a short description of the servlet.
*
* @return a String containing servlet description
*/
@Override
public String getServletInfo() {
return "Short description";
}// </editor-fold>
}

  • Create pull request into master

Remediation feedback:

  • 👍 Like
  • 👎 Dislike

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior SQL Injection Training

● Videos

   ▪ Secure Code Warrior SQL Injection Video

● Further Reading

   ▪ OWASP SQL Injection Prevention Cheat Sheet

   ▪ OWASP SQL Injection

   ▪ OWASP Query Parameterization Cheat Sheet

Request Suppression
  • ... as False Alarm
  • ... as Acceptable Risk

Note: GitHub may take a few seconds to process actions triggered via checkboxes.
Please wait until the change is visible before continuing.

Findings Overview

Severity Vulnerability Type CWE Language Count
High XPath Injection CWE-643 Java* 1
High Cross-Site Scripting CWE-79 Java* 12
High SQL Injection CWE-89 Java* 22
High Path/Directory Traversal CWE-22 Java* 1
Medium XML External Entity (XXE) Injection CWE-611 Java* 1
Medium Error Messages Information Exposure CWE-209 Java* 1
Medium Unsafe Reflection CWE-470 Java* 1
Low Unvalidated/Open Redirect CWE-601 Java* 1
Low HTTP Header Injection CWE-113 Java* 2
Low Cookie Without 'HttpOnly' Flag CWE-1004 Java* 2
Low Arbitrary Server Connection CWE-941 Java* 2
Low Weak Hash Strength CWE-328 Java* 1

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: code security findingsCode security findings detected by Mend

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions