storage/zap-report/zap-sqli-report.html
| Risk Level | Number of Alerts |
|---|---|
| High | |
| 1 | |
| Medium | |
| 0 | |
| Low | |
| 1 | |
| Informational | |
| 1 | |
| False Positives: | |
| 0 | |
For each step: result (Pass/Fail) - risk (of highest alert(s) for the step, if any).
| Name | Risk Level | Number of Instances |
|---|---|---|
| SQL Injection | High | 1 |
| Cookie No HttpOnly Flag | Low | 2 |
| Session Management Response Identified | Informational | 2 |
| High | SQL Injection | | --- | --- | | Description | SQL injection may be possible. | | | | URL | http://127.0.0.1:8003/admin/catalog/categories?locale=%27 | | Node Name | http://127.0.0.1:8003/admin/catalog/categories (locale) | | Method | GET | | Parameter | locale | | Attack | ' | | Evidence | HTTP/1.1 500 Internal Server Error | | Other Info | | | Instances | 1 | | Solution | Do not trust client side input, even if there is client side validation in place.
In general, type check all data on the server side.
If the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?'
If the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries.
If database Stored Procedures can be used, use them.
Do *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality!
Do not create dynamic SQL queries using simple string concatenation.
Escape all data received from the client.
Apply an 'allow list' of allowed characters, or a 'deny list' of disallowed characters in user input.
Apply the principle of least privilege by using the least privileged database user possible.
In particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact.
Grant the minimum database access that is necessary for the application. | | Reference | https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html | | CWE Id | 89 | | WASC Id | 19 | | Plugin Id | 40018 |
| Low | Cookie No HttpOnly Flag | | --- | --- | | Description | A cookie has been set without the HttpOnly flag, which means that the cookie can be accessed by JavaScript. If a malicious script can be run on this page then the cookie will be accessible and can be transmitted to another site. If this is a session cookie then session hijacking may be possible. | | | | URL | http://127.0.0.1:8003/admin/catalog/categories?locale=en_US | | Node Name | http://127.0.0.1:8003/admin/catalog/categories (locale) | | Method | GET | | Parameter | XSRF-TOKEN | | Attack | | | Evidence | Set-Cookie: XSRF-TOKEN | | Other Info | | | URL | http://127.0.0.1:8003/admin/catalog/products?locale=en_US | | Node Name | http://127.0.0.1:8003/admin/catalog/products (locale) | | Method | GET | | Parameter | XSRF-TOKEN | | Attack | | | Evidence | Set-Cookie: XSRF-TOKEN | | Other Info | | | Instances | 2 | | Solution | Ensure that the HttpOnly flag is set for all cookies. | | Reference | https://owasp.org/www-community/HttpOnly | | CWE Id | 1004 | | WASC Id | 13 | | Plugin Id | 10010 |
| Informational | Session Management Response Identified | | --- | --- | | Description | The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to "Auto-Detect" then this rule will change the session management to use the tokens identified. | | | | URL | http://127.0.0.1:8003/admin/catalog/categories?locale=en_US | | Node Name | http://127.0.0.1:8003/admin/catalog/categories (locale) | | Method | GET | | Parameter | unopim_session | | Attack | | | Evidence | unopim_session | | Other Info | cookie:unopim_session
cookie:XSRF-TOKEN | | URL | http://127.0.0.1:8003/admin/catalog/products?locale=en_US | | Node Name | http://127.0.0.1:8003/admin/catalog/products (locale) | | Method | GET | | Parameter | unopim_session | | Attack | | | Evidence | unopim_session | | Other Info | cookie:unopim_session
cookie:XSRF-TOKEN | | Instances | 2 | | Solution | This is an informational alert rather than a vulnerability and so there is nothing to fix. | | Reference | https://www.zaproxy.org/docs/desktop/addons/authentication-helper/session-mgmt-id/ | | CWE Id | | | WASC Id | | | Plugin Id | 10112 |
With the associated active scan results.