Consider the following Python program #dbuser and dbpwd are obtained from a # configuration file con...

Transcribed Image Text:

Consider the following Python program #dbuser and dbpwd are obtained from a # configuration file con = pymysql.connect('localhost', dbuser, dbpwd, 'database') # get parameters from web request uid = getRequest Parameter("uid") with con: cur = con.cursor() Python cur.execute("SELECT * FROM users WHERE user_id=" + uid) firstname, lastname = cur.fetchone () print("Welcome " + firstname + " " + lastname) (i) What vulnerability does this program have? Briefly explain the vulnerability in general and, in particular, why this program is vulnerable. DO (ii) Modify this program to fix the vulnerability. (iii) Briefly explain why your modified version is secure. Consider the following Python program #dbuser and dbpwd are obtained from a # configuration file con = pymysql.connect('localhost', dbuser, dbpwd, 'database') # get parameters from web request uid = getRequest Parameter("uid") with con: cur = con.cursor() Python cur.execute("SELECT * FROM users WHERE user_id=" + uid) firstname, lastname = cur.fetchone () print("Welcome " + firstname + " " + lastname) (i) What vulnerability does this program have? Briefly explain the vulnerability in general and, in particular, why this program is vulnerable. DO (ii) Modify this program to fix the vulnerability. (iii) Briefly explain why your modified version is secure.

Answer rating: 100% (QA)

Vulnerability in the Python program The Python program is vulnerable to SQL injectionSQL injection is a type of injection attack that allows an attacker to interfere with the queries that an applicati... View the full answer