From adbefbf7c09efb151e41c76c7b31b4c9cb235b41 Mon Sep 17 00:00:00 2001
From: Jamie Allen <jamie.allen@snyk.io>
Date: Mon, 17 Nov 2025 23:53:56 +0200
Subject: [PATCH] Introduce SQL Injection vulnerability in Open.java and add
 vulnerable dependency to pom.xml

---
 .../cysecurity/cspf/jvl/controller/Open.java   | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java b/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java
index 9cf1a268..485a5737 100644
--- a/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java
+++ b/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java
@@ -8,6 +8,10 @@
 
 import java.io.IOException;
 import java.io.PrintWriter;
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.ResultSet;
+import java.sql.Statement;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
@@ -42,6 +46,20 @@ protected void processRequest(HttpServletRequest request, HttpServletResponse re
            {
                out.print("Missing url parameter");
            }
+           String userId = request.getParameter("userId");
+           if (userId != null) {
+               try {
+                   Connection conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/vulnerableDB", "root", "password");
+                   Statement stmt = conn.createStatement();
+                   String query = "SELECT * FROM users WHERE id = '" + userId + "'";
+                   ResultSet rs = stmt.executeQuery(query);
+                   while (rs.next()) {
+                       out.println("User: " + rs.getString("username"));
+                   }
+               } catch (Exception e) {
+                   e.printStackTrace();
+               }
+           }
         }
          catch(Exception e)
          {