Databases
StackOverflow2013
Postsdbo
POBlind Sql injection in application developed using spring mvc
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POBlind Sql injection in application developed using spring mvc
    text
    copied!<p>I am using Spring MVC for developing my web application.My problem is ,when I have done APPSCAN of my web application,it report BLIND SQL INJECTION in many of parameters in my SPRING MVC form.I am using bean for fetching data from SPRING MVC form and save() function in Spring framework for saving data to database.How I can resolve my ploblem?</p> <p>My sample code is below..</p> <p>Login.jsp contains link</p> <pre><code>&lt;script&gt; function openUserReg(){ window.open("/ma/UserReg.nic"); } &lt;/script&gt; &lt;body&gt; &lt;form:form&gt; &lt;a href="#" onclick="openUserReg();"&gt;Producer/ Dealer Registration(Public)&lt;/a&gt; &lt;/form&gt; &lt;/body&gt; </code></pre> <p>configuration of <code>UserReg.nic</code> is</p> <pre><code>&lt;beans&gt; &lt;bean id="urlMapping" class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping"&gt; &lt;property name="mappings"&gt; &lt;props&gt; &lt;prop key="UserReg.nic"&gt;UserRegController&lt;/prop&gt; &lt;/props&gt; &lt;/property&gt; &lt;/bean&gt; &lt;bean id="UserRegController" class="nic.mams.web.UserRegController"&gt; &lt;property name="commandName"&gt;&lt;value&gt;userReg&lt;/value&gt;&lt;/property&gt; &lt;property name="commandClass"&gt;&lt;value&gt;nic.mams.web.beans.UserRegBean&lt;/value&gt;&lt;/property&gt; &lt;property name="validator" ref ="UserRegValidator"/&gt; &lt;property name="userRegService" ref="UserRegService"/&gt; &lt;property name="pages"&gt; &lt;list&gt; &lt;value&gt;userRegistration.jsp&lt;/value&gt; &lt;value&gt;successRegistration.jsp&lt;/value&gt; &lt;/list&gt; &lt;/property&gt; &lt;/bean&gt; </code></pre> <p><strong>userRegistration.jsp</strong> contains</p> <pre><code>&lt;form:input path="name" id="name" cssClass="control" maxlength="25" onclick="hidErMsg('er01');hidErMsgInnerHtml('err1');" autocomplete="off"/&gt; </code></pre> <p>And the controller class contains the code</p> <pre><code> public class UserRegController extends AbstractWizardFormController{ UserRegService userRegService; protected Map referenceData(HttpServletRequest req, Object obj, Errors er, int page) throws Exception {..... return map; } protected ModelAndView processFinish(HttpServletRequest req,HttpServletResponse res, Object obj, BindException be) throws Exception { UserRegBean bean = (UserRegBean)obj; Applicant app=new Applicant(); ... app.setName(bean.getName()); userRegService.saveApp(app); } } </code></pre> <p>saveApp(app) function in UserRegService contains the code</p> <pre><code>saveApp(app){ String success = "No"; Session session=getSessionFactory().openSession(); Transaction tx=session.beginTransaction(); try { getHibernateTemplate().save(app); tx.commit(); session.close(); success = "Yes"; } catch (Exception e) { e.printStackTrace(); tx.rollback(); } if (success.equals("Yes")){ return getHibernateTemplate().find("SELECT DISTINCT l.applicantLoginId,l.username,a.appServiceId,a.name,a.panNo " + "FROM ApplicantLogin as l INNER JOIN l.applicants as a " + "WHERE l.applicantLoginId=? AND l.applicantLoginId=a.applicantLogin AND a.applicantStatus is null " + "AND a.transferType is null AND a.registrationStatus is not null ",applntlg.getApplicantLoginId()); } return null; } </code></pre> <p>Appscan results this </p> <pre><code> [17 of 26] Blind SQL Injection Severity: High Test Type: Application Vulnerable URL: UserReg.nic (Parameter: name) CVE ID(s): N/A CWE ID(s): 89 Remediation Tasks: Review possible solutions for hazardous character injection </code></pre> <p>Any one any suggestion please provide me.</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload