Questions:
5. a. The weakness prevalence of the SQL injection issue is high. Many SQL databases
hold sensitive data that should be protected; this issue causes the data to be at risk. Per the CWE
information there is a high likelihood that this weakness can be used by those with malicious
intent. Not only does this represent a threat to the sensitive data, but can also be used to gain
access to user names and passwords, and additional data by creating new reports. [ CITATION
MIT19 \l 1033 ]
b. Attackers can exploit the SQL injection vulnerability in several ways. They could
access confidential and sensitive data by hijacking user data, they could create new SQL queries
that gives access to confidential information or, make changes to existing data. Hackers can
essentially get access to the data, modify it, pull additional data, and manipulate the system.
[ CITATION MIT19 \l 1033 ]
c. There are several different architecture and design strategies suggested in the
article to avoid the SQL injection vulnerability. One suggestion is to use “vetted libraries or
framework that does not allow the weakness to occur.”[ CITATION MIT19 \l 1033 ] This
suggests to use Javabeans or Hibernate to create parameterized queries. These will not give
complete protection from SQL injection but do make it less likely. [ CITATION Gna20 \l 1033 ]
CSIS 330 – Lab 6: Identifying Security
Vulnerabilities Answer Template
d. One of the implementation approaches recommended is input validation. This
suggest using only those inputs that are known as ‘allowed, or good’. This includes rejecting
syntax or extra values that are not on the white list as acceptable.
e. There are many different CWEs that have been released related to this issue.
These include: “Research Concepts (CWE 1000)” and “Architectural Concepts (CWE-1008)”.
[ CITATION MIT19 \l 1033 ]
6. a. The description summary of CWE-89 states: “The software constructs all or part
of an SQL command using externally-influenced input from an upstream component, but it does
not neutralize or incorrectly neutralizes special elements that could modify the intended SQL
command when it is sent to a downstream component.” [ CITATION MIT19 \l 1033 ]
b. This is a weakness that can occur within Database server platforms.
c. The likelihood of exploit of this weakness is listed in the CWE as high.
d. One of the detection methods or strategies listed is a firewall. The firewall can be
used to detect attacks it is considered an emergency prevention measure. [ CITATION MIT19 \l
1033 ]
e. One of the examples given tell of web servers that were compromised using a
SQL injection attack. The injection modified websites so that those websites in turn were used as
malicious code. [ CITATION MIT19 \l 1033 ]
Gnanasundar, P. (2020, February 1). How to Fix SQL Injection using Hibernate. Retrieved from
SANS DevSecOps: https://software-security.sans.org/developer-how-to/fix-sql-injection-
in-java-hibernate
