CRITICAL
SQL Injection Vulnerability
Vulnerable Trace: API Endpoint /v1/auth/loginverified_user
122
const { username, password } = req.body;
123
const query = `SELECT * FROM users WHERE username = '${username}' AND password = '${password}'`;
124
db.execute(query); ⚠️ INJECTION POINT DETECTED
Detected Payload:
' OR '1'='1Proposed Patch (Parameterized Query)
123
const query = "SELECT * FROM users WHERE username = ? AND password = ?";
124
db.execute(query, [username, password]);