Currently Working on HP Fortify Access Control Database category.
userId = request.getParameter(Constants.USERID).trim();
I saw the definition provided by Fortify that is:
Without proper access control, executing a SQL statement that contains a user-controlled primary key can allow an attacker to view unauthorized records.
In these application primary id is different (i.e Userid is not a primary of that table)
- What kind of stuff attacker will do with these vulnerabilities?
- How can attackers exploit these vulnerabilities?
- How we can say that there is an actual issue not a false positive?
- Any suggested remediation for these kinds of vulnerabilities?