PBinnell768938 (Community Member) asked a question.
Veracode is reporting a CWE-89 for the following function. It is using a parameterized SQL query but still indicates the flaw. Can anyone point out why this is happening?
Public Sub ExecNonQuery(ByVal sqlCmd As SqlCommand, ByVal pra1 As String, Optional ByVal pra2 As String = "", Optional ByVal pra3 As String = "")
Dim sqlCnn As SqlConnection = Nothing
Dim sqlParam As System.Data.SqlClient.SqlParameter
Try
sqlCnn = New SqlConnection(CONNECTION_STRING)
sqlCnn.Open()
sqlCmd.Connection = sqlCnn
sqlParam = sqlCmd.Parameters.Add("@pr1", SqlDbType.VarChar)
sqlParam.Value = pra1
sqlParam.Direction = ParameterDirection.Input
If pra2 <> "" Then
sqlParam = sqlCmd.Parameters.Add("@pr2", SqlDbType.VarChar)
sqlParam.Value = pra2
sqlParam.Direction = ParameterDirection.Input
End If
If pra3 <> "" Then
sqlParam = sqlCmd.Parameters.Add("@pr3", SqlDbType.VarChar)
sqlParam.Value = pra3
sqlParam.Direction = ParameterDirection.Input
End If
sqlCmd.CommandTimeout = 60
sqlCmd.ExecuteNonQuery()
Catch ex As SqlException
Throw New Exception("SQL String: " & sqlCmd.CommandText.ToString & vbNewLine & "SQL Server Error: " + vbNewLine + ex.ToString)
Catch ex As Exception
Throw New Exception("Application Exception: " + vbNewLine + ex.ToString)
Finally
If Not sqlCmd Is Nothing Then sqlCmd.Dispose()
If Not sqlCnn Is Nothing Then
If sqlCnn.State = ConnectionState.Open Then sqlCnn.Close()
sqlCnn.Dispose()
End If
End Try
End Sub
Thank you,
Paul
.png){kind=logo}
Hello , I Analyze your code and i want to tell you that is not difficult to understand easily you can follow this steps :
Veracode is reporting CWE-89, which stands for "SQL Injection," for the provided function despite the use of parameterized SQL queries. The reason for this could be related to how the input parameters
pra1
,
pra2
, and
pra3
are handled.
Although you are using parameterized queries for the main SQL command, the issue might arise if the values of
pra1
,
pra2
, or
pra3
come from untrusted sources without proper validation or sanitization. If these values are derived from user input or any external source, they should be carefully validated and sanitized before being passed as parameters.
To mitigate the risk of SQL injection, ensure the following:
By implementing these precautions, you can help prevent SQL injection vulnerabilities and potentially address the reported CWE-89 issue in Veracode.
Hi @PBinnell768938 (Community Member) ,
You reached out to us through Veracode Support. Thank you for that, please do note that most contracts with Veracode include Advanced Technical Support, so feel free to make use of us! For example through the Veracode Platform: https://docs.veracode.com/r/start_support .
Just wanted to close the loop here and confirm the suspicions of @crogers164260 (Community Member) . We reviewed this in the Veracode Platform and saw that the query was dynamically constructed with user input before it entered this function.
Our recommendation is also similar, use hardcoded schema identifiers where possible. This may not always be possible, if not, use strict allowlist validation and document this in a mitigation proposal for manual review by your companies mitigation approver.
Well done @crogers164260 (Community Member) !
Thank you,
Boy Baukema