fix: parameterize blind SQL injection level 1

[tobymoreno]

Summary

• replace BlindSQLInjectionVulnerability Level 1 SQL concatenation with a prepared statement
• bind the supplied car id as a single query parameter
• preserve present and absent car response behavior
• add a regression proving 1 OR 1=1 never enters the SQL text

Validation

• ./gradlew test --tests org.sasanlabs.service.vulnerability.sqlInjection.BlindSQLInjectionVulnerabilityTest
• ./gradlew spotlessCheck test
• git diff --check

[github-actions]

🏆 VulnerableApp — CTF Patch Score

░░░░░░░░░░░░░░░░░░░░  1 / 187 pts  (1%)

1 / 110 challenges patched

Per-challenge detail is withheld — it would reveal the rubric.

Commit: c99b8f9 · scoring run

🎉 Your result is on the leaderboard — see where you rank! 🏆