SAMATE Logo NIST Logo The SAMATE Project Department of Homeland Security
Downloads:  Download this Test Case #156495

Back to the previous page... Back to the previous page

Test Case IDCandidate156495
Bad / Good / MixedBadBad test case
AuthorIARPA STONESOUP Test and Evaluation team
Associations
Test suite: 102  
Application: 11  
Added byCharles Oliveira
LanguageJava
Type of test caseSource Code
Input string
Expected Output
Instructions
See src/build.xml and src/maven-build.xml.
Submission date2015-10-06
DescriptionUsing Hibernate to execute a dynamic SQL statement with
built-in user-controlled input can allow an attacker to modify the
statement's meaning or to execute arbitrary SQL commands.

Metadata
- Base program: Apache Jena
- Source Taint: SOCKET
- Data Type: SIMPLE
- Data Flow: ADDRESS_AS_CONSTANT
- Control Flow: BREAK_WITH_LABEL
File(s)
Flaw

There are no comments
Have any comments on this test case? Please, .

File Contains:
CWE-564: SQL Injection: Hibernate on line(s): 343, 344, 345, 346, 347, 348, 349, 350, 351, 352, 353, 354, 355, 356, 357, 358, 359, 360, 361, 362, 363, 364, 365, 366, 367, 368, 369, 370, 371, 372, 373, 374, 375, 376, 377, 378, 379, 380, 381, 382, 383