public class SubsidyVerificationService {
    @Autowired
    private UserRepository userRepository;
    
    public boolean verifyUserEligibility(Long userId) {
        // Vulnerable SQL query - concatenates user input directly
        String query = "SELECT * FROM users WHERE id = " + userId + " AND status = 'ACTIVE'";
        User user = userRepository.executeRawQuery(query);
        
        if (user == null) {
            return false;
        }
        
        // No privilege check before accessing sensitive data
        return checkGovernmentCriteria(user);
    }
    
    private boolean checkGovernmentCriteria(User user) {
        // Implementation details...
    }
}

@RestController
@RequestMapping("/api/payments")
public class PaymentDistributionController {
    
    @PostMapping("/distribute")
    public ResponseEntity distributePayment(
            @RequestBody PaymentRequest request,
            @RequestHeader("X-User-Role") String userRole) {
        
        // No proper validation of user role
        if (userRole.contains("admin")) {
            // Process payment without proper authorization checks
            PaymentService.distribute(request.getAmount(), request.getRecipientId());
            return ResponseEntity.ok().build();
        }
        
        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
    }
}