CX Connection_String_Injection @ src/main/java/org/cysecurity/cspf/jvl/controller/Install.java [refs/heads/master]

[juegge]

Connection_String_Injection issue exists @ src/main/java/org/cysecurity/cspf/jvl/controller/Install.java in branch refs/heads/master

The application's setup method receives untrusted, user-controlled data, and uses this data to connect to a database using BinaryExpr, at line 121 of src\main\java\org\cysecurity\cspf\jvl\controller\Install.java. This may enable a Connection String Injection attack.
The attacker can inject the connection string via user input, ""dbname"", which is retrieved by the application in the processRequest method, at line 58 of src\main\java\org\cysecurity\cspf\jvl\controller\Install.java.

Severity: High

CWE:99

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 54 58

---

Code (Line #54):

        dburl = request.getParameter("dburl");

---

Code (Line #58):

        dbname = request.getParameter("dbname");

---

[juegge]

Issue still exists.

[juegge]

Issue still exists.

[juegge]

Issue still exists.

[github-actions]

Issue still exists.

[github-actions]

Issue still exists.

[github-actions]

Issue still exists.

[github-actions]

Issue still exists.