Currently Working on HP Fortify Access Control Database category.


userId = request.getParameter(Constants.USERID).trim();



I saw the definition provided by Fortify that is:

Without proper access control, executing a SQL statement that contains a user-controlled primary key can allow an attacker to view unauthorized records.

In these application primary id is different (i.e Userid is not a primary of that table)

  1. What kind of stuff attacker will do with these vulnerabilities?
  2. How can attackers exploit these vulnerabilities?
  3. How we can say that there is an actual issue not a false positive?
  4. Any suggested remediation for these kinds of vulnerabilities?

What kind of stuff can an attacker do with this vulnerability?

I will assume that my request looks like this: GET /editPassword?userID=163495&password=myNewPassword

In this case, an attacker can simply change the userID and thus edit the password of another user. Even if it's just read access, by having the user supply the ID, it can be changed to arbitrary values, even if your application always sets it to the "correct" IDs.

How can an attacker exploit this vulnerability?

That entirely depends on the application, and what you consider an exploit.

For example, on Stack Exchange, I can look at people's profiles, knowing just their IDs. Maybe this is what you want, maybe not.

If your only defense against anybody viewing any content in the database is just that they never try to insert a different ID, then you don't have any defense at all.

How can we determine if it's an actual issue?

Again, depends on your application. Is it okay that users can read arbitrary records? If so, then it's fine. Otherwise you need to add some kind of authorization mechanism, to see if the request is authorized to view this information.

Any suggested remediation for this vulnerability?

Depends on your codebase. I can't fix your code by knowing 2 lines of it.

  • By looking at the given what you say is it vulnerable to access control or not – useradmin1234 Aug 13 at 12:58
  • And if the data comes from the db than whats you opinion – useradmin1234 Aug 13 at 12:59
  • @useradmin1234 You are asking me for a pen-and-paper pentest. I can't do that, just like a doctor can't give you a diagnosis with good conscience if you call them and explain that sometimes your head hurts and your stomache feels weird at times. If you want a reasonable amount of assurance that your code is safe or vulnerable in your specific case, you must conduct a proper test. – MechMK1 Aug 13 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.