KAgarwal733760 (Community Member) asked a question.
During my project scan, I identified a high-severity flaw that persists in the Core DB file. Veracode provides no initial file from which the issue comes.
While we’ve diligently resolved numerous flaw instances after each scan and followed the remediation guidance provided by Veracode, a high-severity flaw continues to appear on the same file even after implementing all recommended fixes. Additionally, new flaw instances keep surfacing in subsequent scans, making it difficult to maintain a stable and compliant security posture.
The reported file appears to be a core component responsible for executing all database queries. As a result, we are getting the same security flaw instance.
Can someone help on how to resolve it as checking all individual DB queries throughout the portal is quite time-consuming?
Thanks
.png){kind=logo}
Hi @KAgarwal733760 (Community Member) - I just connected with a teammate to discuss this issue - we'll need you to schedule a consultation call so that we can go into more depth: https://community.veracode.com/s/article/How-to-schedule-a-consultation-call
The issue here is because of how this routine is centralized within the application. It doesn't seem like the method was designed to handle prepared statement or take in parameters to bind to the query. It just warrants more a discussion into your implementation.