Tag: security

In the following code, which is the location of vulnerability?

1 String username = req.getParameter("loginID"); 
2 String password = req.getParameter("loginPassword"); 
3 String sql = "SELECT UserID from Employee WHERE Emp_ID = ? AND Password=?"; 
4 pstmt = con.prepareStatement(sql); 
5 pstmt.setString(1,username); 
6 pstmt.setString(2,password); 
7 pstmt.execute(); 
8 user = pstmt.getResultSet(); 
9 if(user!=null)  
10 { 
11  while (user.next()) 
12  { 
13   userInfo.add(user.getString(1)); 
14  }  
15 } 
16 else 
17 { 
18  log.debug(“Invalid Login: Login ID-”+ username+” Password-”+ password); 
19 }

Identify the line on which the vulnerability exists:

1 public class performSearchAction extends HttpServlet{ 
2 // Servlet for Search Action  
3  public void doPost(HttpServletRequest req, HttpServletResponse res)  
4  { 
5   try 
6   { 
7       ArrayList arrSearch =  Util.performSearchAction(req, res); 
8       req.setAttribute(“SearchResults”,arrSearch); 
9       RequestDispatcher rd = getServletContext().getRequestDispatcher("/SearchResult.jsp"); 
10      rd.forward(req,res); 
11  } catch (Exception e) { 
12               log.debug(“Exception occurred:”+e); 
13               } 
14  } //End of doPost method 
15  public void doGet(HttpServletRequest req, HttpServletResponse res) 
16  { 
17    doPost(req,res); 
18  } //End of doGet method 
19 } //End of Class

Give the name of the vulnerability resides in the below code:

... 
Runtime rt = Runtime.getRuntime(); 
Process proc = rt.exec("cmd.exe /c type "+request.getParameter("path")); //path is an Input Parameter and contains the file name. 
InputStream stdin = proc.getInputStream(); 
InputStreamReader isr = new InputStreamReader(stdin); 
BufferedReader br = new BufferedReader(isr);              
...

What can go wrong in following code?

#include   
int main(int argc, char *argv[]) {

if(argc != 3) {
        printf("usage: %s [source] [dest]\n", argv[0]);
        exit(1);

    }

    char x;
    FILE *file[2];
    file[0] = fopen(argv[1],"r+");
    file[1] = fopen(argv[2],"w+");
    for(x = 0; x < 2; x++) { 
        if(file[x] == NULL) {
            printf("error opening file.\n");
            exit(1);
        }
    }

    do {
        x = fgetc(file[0]);
        fputc(x,file[1]);
    } while(x != EOF);

     for(x = 0; x < 2; x++)
        fclose(file[x]);
     return 0; 
}