Is native IMS vulnerable to injections?

Question

As shown in this article, DB2 might be vulnerable to SQL Injections:

* Potential SQL injection if X, Y or Z host variables come from untrusted input 
STRING "INSERT INTO TBL (a,b,c) VALUES (" X "," Y "," Z ")" INTO MY-SQL.
EXEC SQL PREPARE STMT FROM :MY-SQL END-EXEC.
EXEC SQL EXECUTE STMT END-EXEC.

My question is if native IMS commands are vulnerable of this kind (or similar) injections? For instance, by imputing malicious input in the ISRT DLI command.

Answer 1

It depends on how you plan to access the IMS database.

Quoting from an IBM document.

The SQL statements that you issue through the web interface or the ISPF interface are executed as IMS application programming API in the IMS SPUFI application program in z/OS®. You can select COBOL or Java™ for the language environment to execute SQL statements.

If you use SQL, you're possibly vulnerable to SQL injection.

If you use native IMS commands, probably not. But it's still a good idea to sanitize your inputs, even for native IMS commands.