CVE-2013-10009: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in DrAzraelTod pyChao and classified as critical. Affected by this issue is the function klauen/lesen of the file mod_fun/__init__.py. The manipulation leads to sql injection. The patch is identified as 9d8adbc07c384ba51c2583ce0819c9abb77dc648. It is recommended to apply a patch to fix this issue. VDB-217634 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-07T20:15Z
Repository: https://github.com/DrAzraelTod/pyChao
Language: Python
Files changed: mod_fun/__init__.py
Commit date: 2013-11-03 14:14:31 +0100
Commit message: fix sql injections

Diff: diff --git a/mod_fun/__init__.py b/mod_fun/__init__.py
index 7d9bf3a..9c4d2d3 100644
--- a/mod_fun/__init__.py
+++ b/mod_fun/__init__.py
@@ -69,11 +69,11 @@ class mod_fun(object):
                 self.parent.privmsg(u'Geht nicht!', params.channel)
         else:
             self.parent.privmsg(u'hast du nicht was vergessen?', params.channel)
     
     def aendern(self, name, amount, item):
-        keks = self.DBcursor.execute(u"SELECT nickname, count from kekse WHERE nickname like '%s' AND item =='%s' LIMIT 1" % (name, item)).fetchall()
+        keks = self.DBcursor.execute(u"SELECT nickname, count from kekse WHERE nickname like ? AND item ==? LIMIT 1", (name, item)).fetchall()
         if(len(keks)>0 and len(keks[0]) > 1):
             keks = keks[0][1]
             if amount == 0:
                 return keks
             keks2 = keks+amount
@@ -104,11 +104,11 @@ class mod_fun(object):
             else:
                 keks = self.aendern(params.args[0],0, name)
                 anrede=u"%s hat" % params.args[0]
             self.parent.privmsg(u"%s %i %s." % (anrede, keks, words['plural']), params.channel)
         elif len(params.args) == 0:
-            keks = self.DBcursor.execute(u"SELECT `nickname`, `count` from kekse WHERE item=='%s' AND `count`>=1 ORDER BY `count` DESC LIMIT 10" % (name)).fetchall()
+            keks = self.DBcursor.execute(u"SELECT `nickname`, `count` from kekse WHERE item==? AND `count`>=1 ORDER BY `count` DESC LIMIT 10", (name)).fetchall()
             if len(keks) <= 0:
                 self.parent.privmsg(u"Es gibt noch keine %s?" % words['plural'], params.channel)
                 return
             kekst = u"[Top-%s-Sammler] " % words['singular']
             first = True

Vulnerable code:         keks = self.DBcursor.execute(u"SELECT nickname, count from kekse WHERE nickname like '%s' AND item =='%s' LIMIT 1" % (name, item)).fetchall()
            keks = self.DBcursor.execute(u"SELECT `nickname`, `count` from kekse WHERE item=='%s' AND `count`>=1 ORDER BY `count` DESC LIMIT 10" % (name)).fetchall()
Fixed code:         keks = self.DBcursor.execute(u"SELECT nickname, count from kekse WHERE nickname like ? AND item ==? LIMIT 1", (name, item)).fetchall()
            keks = self.DBcursor.execute(u"SELECT `nickname`, `count` from kekse WHERE item==? AND `count`>=1 ORDER BY `count` DESC LIMIT 10", (name)).fetchall()