CX Code_Injection @ src/main/java/org/cysecurity/cspf/jvl/controller/Install.java [master]

[kmcdon83]

Code_Injection issue exists @ src/main/java/org/cysecurity/cspf/jvl/controller/Install.java in branch master

The application's setup method receives and dynamically executes user-controlled code using forName, at line 103 of src\main\java\org\cysecurity\cspf\jvl\controller\Install.java. This could enable an attacker to inject and run arbitrary code. 
The attacker can inject the executed code via user input, ""jdbcdriver"", which is retrieved by the application in the processRequest method, at line 49 of src\main\java\org\cysecurity\cspf\jvl\controller\Install.java.

Severity: High
CWE:94
Vulnerability details and guidance
Internal Guidance
Checkmarx
Lines: 55

---

Code (Line #55):

        jdbcdriver = request.getParameter("jdbcdriver");

---