I'm taking a look at an webapp source code and, although the dev has been careful enough as to use prepared statements to fill in the query's "String" parameters, he/she has filled all the query's "Long" parameters using simple concatenation.
Obs: status has type String, var1 has type Long
Query query = entityManager.createQuery(
"SELECT UPPER(request.attributeValue) FROM PreOrderedRequests request
WHERE request.status = :status AND request.report.id = " + var1);
I know he/she should not have done that, but my question is: has anyone here seen an actual exploit for that? How would one take advantage of this behavior?
For the suspicious ones: I'm not hacking anything. Just a friend of mine that asked me to take a look at this specific piece of code.