← ALL FINDINGS

BG-001 · backend/users.py:42

SQL Injection

CRITICAL✓ FIXED

Vulnerability description

User-controlled request parameter is concatenated directly into a SQL query string.

Security impact

User-controlled input reaches a database query without parameterization. An attacker can read, modify, or destroy arbitrary records in the users table.

Recommended remediation

Use parameterized queries and bind user input as query parameters instead of string concatenation.

Fix

Before

query = "SELECT * FROM users WHERE id=" + user_id
cursor.execute(query)

After

query = "SELECT * FROM users WHERE id = ?"
cursor.execute(query, (user_id,))

Regression test

test_sql_injection_payload_is_not_executed

def test_sql_injection_payload_is_not_executed(client):
    resp = client.get("/api/users/1 OR 1=1")
    assert resp.status_code == 400
    assert User.query.count() == 3

Affected file

backend/users.py

Line 42

Affected code path

GET /api/users/:id → routes.get_user() → users.fetch_user(user_id) → cursor.execute(query)

Verification result

  • ✓Regression test generated
  • ✓Test passed
  • ✓Fix verified