Parameter_Tampering @ /Controllers/RegistrationsController.cs

[msant262]

Checkmarx (SAST): Parameter_Tampering
Security Issue: Read More about Parameter_Tampering
Checkmarx Project: Nova-8/Damm-Vulnerable-CSharp-API
Repository URL: https://github.com/Nova-8/Damm-Vulnerable-CSharp-API
Branch: master
Scan ID: 2f22541b-da6c-459f-9285-99da61e0ed7d

---

Method Post at line 22 of /Controllers/RegistrationsController.cs gets user input from element registrationRequest. This input is later concatenated by the application directly into a string variable containing SQL commands, without being validated. This string is then used in method Post to query the database FirstOrDefault, at line 31 of /Controllers/RegistrationsController.cs, without any additional filtering by the database. This could allow the user to tamper with the filter parameter.

Result 1:
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
Attack Vector:

    1. registrationRequest: /Controllers/RegistrationsController.cs[22,64]
    2. registrationRequest: /Controllers/RegistrationsController.cs[30,35]
    3. email: /Controllers/RegistrationsController.cs[30,55]
    4. Lambda: /Controllers/RegistrationsController.cs[30,21]
    5. Where: /Controllers/RegistrationsController.cs[30,13]
    6. FirstOrDefault: /Controllers/RegistrationsController.cs[31,13]
    Review result in Checkmarx One: Parameter_Tampering