Filename: com/veracode/verademo/controller/ToolsController.java
Line: 53
CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

This call to java.lang.Runtime.exec() contains a command injection flaw.  The argument to the function is constructed using untrusted input.  If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process.  The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data from the variables (new String\[...\]). The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.
Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.  When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.  Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection.
References: <a href="https://cwe.mitre.org/data/definitions/78.html">CWE</a> <a href="https://owasp.org/www-community/attacks/Command_Injection">OWASP</a>

Filename: com/veracode/verademo/controller/ToolsController.java
Line: 83
CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))

This call to java.lang.Runtime.exec() contains a command injection flaw.  The argument to the function is constructed using untrusted input.  If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process.  The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data from the variables (new String\[...\]). The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.
Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.  When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters.  Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection.
References: <a href="https://cwe.mitre.org/data/definitions/78.html">CWE</a> <a href="https://owasp.org/www-community/attacks/Command_Injection">OWASP</a>

Filename: com/veracode/verademo/controller/UserController.java
Line: 165
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/controller/UserController.java
Line: 249
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/controller/UserController.java
Line: 310
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/controller/UserController.java
Line: 374
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable query. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/controller/UserController.java
Line: 479
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlMyEvents. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/controller/UserController.java
Line: 490
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.PreparedStatement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. executeQuery() was called on the myInfo object, which contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/controller/BlabController.java
Line: 467
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.PreparedStatement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. executeQuery() was called on the blabberQuery object, which contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/commands/RemoveAccountCommand.java
Line: 42
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/commands/RemoveAccountCommand.java
Line: 49
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/commands/RemoveAccountCommand.java
Line: 53
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/commands/ListenCommand.java
Line: 40
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/commands/ListenCommand.java
Line: 47
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/commands/IgnoreCommand.java
Line: 40
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>

Filename: com/veracode/verademo/commands/IgnoreCommand.java
Line: 47
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

This database query contains a SQL injection flaw.  The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.
Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.
References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a>