Summary:
The feedback endpoint directly inserts user input into SQL without sanitization or parameterized queries, enabling SQL injection.
Description:
User-controlled values from POST are assigned directly and interpolated into SQL:
No escaping or prepared statements are used.
Steps to Reproduce:
- Open feedback form.
- Submit a crafted payload in comment or name field (for example quote-based injection string).
- Observe SQL behavior deviation or error output.
Expected:
Input should be parameterized and safely handled.
Actual:
Raw input is embedded into SQL query string.
Impact:
Critical security risk: data tampering, unauthorized query execution, possible data loss/exfiltration.
Suggested Labels:
security, backend, sql-injection, high priority
Summary:
The feedback endpoint directly inserts user input into SQL without sanitization or parameterized queries, enabling SQL injection.
Description:
User-controlled values from POST are assigned directly and interpolated into SQL:
No escaping or prepared statements are used.
Steps to Reproduce:
Expected:
Input should be parameterized and safely handled.
Actual:
Raw input is embedded into SQL query string.
Impact:
Critical security risk: data tampering, unauthorized query execution, possible data loss/exfiltration.
Suggested Labels:
security, backend, sql-injection, high priority