Skip to content

Update myprofile.jsp #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jamieallensnyk wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update myprofile.jsp #24

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 35 additions & 1 deletion src/main/webapp/myprofile.jsp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,40 @@
if(session.getAttribute("isLoggedIn")!=null)
{
Connection con=new DBConnect().connect(getServletContext().getRealPath("/WEB-INF/config.properties"));

String id=request.getParameter("id");

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  SQL Injection

Unsanitized input from an HTTP parameter flows into executeQuery, where it is used in an SQL query. This may result in an SQL Injection vulnerability.

Line 16 | CWE-89 | Priority score 825 | Learn more about this vulnerability
Data flow: 6 steps

Step 1 - 3

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 16 in d03d44a

String id=request.getParameter("id");

Step 4 - 6

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 55 in d03d44a

rs=stmt.executeQuery("select * from users where id="+id);

⚡ Fix this issue by replying with the following command: @snyk /fix

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@snyk /fix

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ No fixes found
There were no fixes found for the request

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  SQL Injection

Unsanitized input from an HTTP parameter flows into executeQuery, where it is used in an SQL query. This may result in an SQL Injection vulnerability.

Line 16 | CWE-89 | Priority score 825 | Learn more about this vulnerability
Data flow: 7 steps

Step 1 - 3

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 16 in d03d44a

String id=request.getParameter("id");

Step 4 src/main/webapp/myprofile.jsp#L55

Step 5 - 7

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 63 in d03d44a

ResultSet rs1=stmt.executeQuery("select * from cards where id="+id);

⚡ Fix this issue by replying with the following command: @snyk /fix

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@snyk /fix

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ No fixes found
There were no fixes found for the request

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into print, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 16 | CWE-79 | Priority score 875 | Learn more about this vulnerability
Data flow: 12 steps

Step 1 - 3

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 16 in d03d44a

String id=request.getParameter("id");

Step 4 - 7 src/main/webapp/myprofile.jsp#L55

Step 8 - 12

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 58 in d03d44a

out.print("UserName : "+rs.getString("username")+"<br>");

⚡ Fix this issue by replying with the following command: @snyk /fix

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into print, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 16 | CWE-79 | Priority score 875 | Learn more about this vulnerability
Data flow: 12 steps

Step 1 - 3

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 16 in d03d44a

String id=request.getParameter("id");

Step 4 - 7 src/main/webapp/myprofile.jsp#L55

Step 8 - 12

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 59 in d03d44a

out.print("Email : "+rs.getString("email")+"<br>");

⚡ Fix this issue by replying with the following command: @snyk /fix

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into print, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 16 | CWE-79 | Priority score 875 | Learn more about this vulnerability
Data flow: 12 steps

Step 1 - 3

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 16 in d03d44a

String id=request.getParameter("id");

Step 4 - 7 src/main/webapp/myprofile.jsp#L55

Step 8 - 12

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 60 in d03d44a

out.print("About : "+rs.getString("about")+"<br>");

⚡ Fix this issue by replying with the following command: @snyk /fix

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into print, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 16 | CWE-79 | Priority score 875 | Learn more about this vulnerability
Data flow: 13 steps

Step 1 - 3

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 16 in d03d44a

String id=request.getParameter("id");

Step 4 src/main/webapp/myprofile.jsp#L55

Step 5 - 8 src/main/webapp/myprofile.jsp#L63

Step 9 - 13

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 67 in d03d44a

out.print("Card Number: "+rs1.getString("cardno")+"<br/>");

⚡ Fix this issue by replying with the following command: @snyk /fix

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into print, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 16 | CWE-79 | Priority score 875 | Learn more about this vulnerability
Data flow: 13 steps

Step 1 - 3

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 16 in d03d44a

String id=request.getParameter("id");

Step 4 src/main/webapp/myprofile.jsp#L55

Step 5 - 8 src/main/webapp/myprofile.jsp#L63

Step 9 - 13

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 68 in d03d44a

out.print("CVV: "+rs1.getString("cvv")+"<br/>");

⚡ Fix this issue by replying with the following command: @snyk /fix

@jamieallensnyk jamieallensnyk Jul 12, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into print, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 16 | CWE-79 | Priority score 875 | Learn more about this vulnerability
Data flow: 13 steps

Step 1 - 3

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 16 in d03d44a

String id=request.getParameter("id");

Step 4 src/main/webapp/myprofile.jsp#L55

Step 5 - 8 src/main/webapp/myprofile.jsp#L63

Step 9 - 13

JavaVulnerableLab/src/main/webapp/myprofile.jsp

Line 69 in d03d44a

out.print("Expiry Date: "+rs1.getString("expirydate")+"<br/>");

⚡ Fix this issue by replying with the following command: @snyk /fix

if(id!=null && !id.equals(""))
{
Statement stmt = con.createStatement();
ResultSet rs =null;
rs=stmt.executeQuery("select * from users where id="+id);
if(rs != null && rs.next())
{
out.print("UserName : "+rs.getString("username")+"<br>");
out.print("Email : "+rs.getString("email")+"<br>");
out.print("About : "+rs.getString("about")+"<br>");

//Getting Card Details:
ResultSet rs1=stmt.executeQuery("select * from cards where id="+id);
if(rs1 != null && rs1.next())
{
out.print("<br/>-------------------<br/>Card Details:<br/>-------------------<br/>");
out.print("Card Number: "+rs1.getString("cardno")+"<br/>");
out.print("CVV: "+rs1.getString("cvv")+"<br/>");
out.print("Expiry Date: "+rs1.getString("expirydate")+"<br/>");
}
else
{
out.print("<br/>No Card Details Found: <a href='changeCardDetails.jsp'>Add Card</a><br/>");
}
}
}
else
{
out.print("ID Parameter is Missing");
}



String id=request.getParameter("id");
if(id!=null && !id.equals(""))
Expand Down Expand Up @@ -62,4 +96,4 @@ else

%>

<%@ include file="/footer.jsp" %>
<%@ include file="/footer.jsp" %>