The below ones are basic way to prevent SQL injection:
All queries should be parameterized.
All dynamic data should be explicitly bound to parameterizedqueries.
String concatenation should never be used to createdynamic SQL.
Effective way of using prepared statement.
Example:
StringselectStatement = "SELECT * FROM User WHERE userId = ? ";
PreparedStatementprepStmt = con.prepareStatement(selectStatement);
prepStmt.setString(1,userId);
ResultSetrs = prepStmt.executeQuery();
Though PS helps in defending againstSQL Injection, but there are possibilities
of SQL Injection attacks throughinappropriate usage of PS.
Example: StringstrUserName = request.getParameter("Txt_UserName");
PreparedStatementprepStmt = con.prepareStatement("SELECT * FROM
user WHERE userId ='+strUserName+'");
Hope this helps.
Regards,
JB
On Tuesday, 27 January 2015 7:43 AM, Vishwas Babu
<[email protected]> wrote:
Hi Jagdish,
Thanks for reaching out :) We could definitely use your expertise to improve on
the security of MifosX
I had a quick look at the attached report and many of the listed
vulnerabilities might not exist as we use prepared statements on the server
side to which variables are passed in.
Do you think you would be able to filter and prioritize the vulnerabilities
with injection examples and we can take a stab at fixing them ?
Regards,Vishwas
P.S: I saw your mail today and suspect most other users on the list might have
missed it too ( for some reason Gmail has marked it as a spam..Be careful with
this message. Our systems couldn't verify that this message was really sent by
yahoo.com.)
On 30 December 2014 at 03:52, Jagadish Bidarkoti <[email protected]>
wrote:
Hi,
I am Jagadish Bidarkoti working for Thomson Reuters as an enterprise architect.
I have been watching this space quite sometime and always tried to contribute,
but somehow time was a big constraint.
Security is an important aspect of any application and any ADM, and that too
for an application deals financials need to be more secure and robust.
Recently I tried to test / penetrate mifos and saw there are more number of
security vulnerabilities in it in very first level of small tool based
penetration, such as SQL, XSS etc. Its important this kind of application
should support these kind of security issues
(https://www.owasp.org/index.php/Testing_Checklist).
I have attached the report and the documentation around setting up mifos and
ZAP (security penetration tool).
How to deal / mitigate these issues? i think it's time for secure coding.
Thanks,JB
------------------------------------------------------------------------------
Dive into the World of Parallel Programming! The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net
_______________________________________________
Mifos-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mifos-users
------------------------------------------------------------------------------
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
_______________________________________________
Mifos-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mifos-users
