CVE-2014-125046: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability, which was classified as critical, was found in Seiji42 cub-scout-tracker. This affects an unknown part of the file databaseAccessFunctions.js. The manipulation leads to sql injection. The patch is named b4bc1a328b1f59437db159f9d136d9ed15707e31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217551.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-06T10:15Z
Repository: https://github.com/Seiji42/cub-scout-tracker
Language: JavaScript
Files changed: databaseAccessFunctions.js
Commit date: 2014-12-09 19:29:24 -0700
Commit message: Added protection from sql injection and dubug flag

Diff: diff --git a/databaseAccessFunctions.js b/databaseAccessFunctions.js
index 0dd6bb8..e4c6deb 100644
--- a/databaseAccessFunctions.js
+++ b/databaseAccessFunctions.js
@@ -18,73 +18,83 @@ function hashPassword(password)
 		hash+=password[i].charCodeAt()*37;
 	}
 	return hash;
 }
 
-function selectAdult(username, connection)
+function insertAdult(firstName, lastName, username, password, packNumber, 
+		leaderType, rankType, phoneNumber, connection)
 {
-	var strQuery = "SELECT * FROM adult WHERE username= '" +connection.escape(username)+"'";
+	var temp= selectAdult(username, connection);
+
+	if(temp.databaseObject.adult_id<1)
+	{
+		return temp;
+	}
+	var strQuery = "INSERT INTO adult VALUES('"+
+	connection.escape(firstName)               +"', '"+
+	connection.escape(lastName)                +"', '"+
+	connection.escape(username)                +"', '"+
+	connection.escape(hashPassword(password))  +"', '"+ 
+	connection.escape(packNumber)              +"', '"+	
+	connection.escape(leaderType)              +"', '"+ 
+	connection.escape(rankType)                +"', '"+
+	connection.escape(phoneNumber)             +"', 'NULL')";
 
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{
-				temp= rows[0];
-				temp.password="";
+				temp= new Adult(row[0]);
 				if(debug)
-				{console.log("SelectAdult \n"+rows[0]+"\n");}
-				
-				return temp;
+				{console.log("insertAdult \n"+rows[0]+"\n");}
+
+				return addScoutsToParent(temp);
 			}
 			});
 }
 
-function validateAdult(username, password, connection)
+function selectAdult(username, connection)
 {
-	var strQuery = "SELECT * FROM adult WHERE username= '" +connection.escape(username)+"'" +"AND password= '"
-	+ hashPassword(password)+"'";
+	var strQuery = "SELECT * FROM adult WHERE username= '" +connection.escape(username)+"'";
 
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{
 				temp= rows[0];
 				temp.password="";
-				
 				if(debug)
-				{console.log("validateAdult \n"+rows[0]+"\n");}
-				
+				{console.log("SelectAdult \n"+rows[0]+"\n");}
+
 				return temp;
 			}
 			});
 }
 
-function insertAdult(firstName, lastName, username, password, packNumber, 
-		leaderType, rankType, phoneNumber, connection)
+function validateAdult(username, password, connection)
 {
-	var temp= selectAdult(username, connection);
+	var strQuery = "SELECT * FROM adult WHERE username= '" +
+	connection.escape(username)+"'" +"AND password= '"     + 
+	connection.escape(hashPassword(password))+"'";
 
-	if(temp.databaseObject.adult_id<1)
-	{
-		return temp;
-	}
-	var strQuery = "INSERT INTO adult VALUES('"+firstName+"', '"+lastName+"', '"+
-	username + "', '" +hashPassword(password) + "', '" + packNumber+"', '"+
-	leaderType +"', '"+ rankType+"', '"+phoneNumber+ "', 'NULL')";
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{
-				temp= new Adult(row[0]);
+				temp= rows[0];
+				temp.password="";
+
 				if(debug)
-				{console.log("insertAdult \n"+rows[0]+"\n");}
-				
-				return addScoutsToParent(temp);
+				{console.log("validateAdult \n"+rows[0]+"\n");}
+
+				return temp;
 			}
 			});
 }
 
+
+
 function updateAdult(firstName, lastName, username, password, packNumber, 
 		leaderType, rankType, phoneNumber,adultID, connection)
 {
 	var temp= selectAdult(username, connection);
 
@@ -92,30 +102,41 @@ function updateAdult(firstName, lastName, username, password, packNumber,
 	{
 		temp= new Adult(firstName, lastName, username, packNumber, 
 				leaderType, rankType, phoneNumber,-1);
 		return temp;
 	}
-	var strQuery = "UPDATE adult SET first_name="+firstName+", last_name="+lastName+", username="+
-	username + ", password=" +hashPassword(password) + ", pack_number=" + packNumber+", leader_type="+
-	leaderType +", rank_type="+ rankType+", phone_number="+phoneNumber+ "WHERE adult_id="+id;
+	var strQuery = "UPDATE adult SET "+
+	"first_name="    +connection.escape(firstName)             +
+	", last_name="   +connection.escape(lastName)              +
+	", username="    +connection.escape(username)              + 
+	", password="    +connection.escape(hashPassword(password))+ 
+	", pack_number=" +connection.escape(packNumber)            +
+	", leader_type=" +connection.escape(leaderType)            +
+	", rank_type="   +connection.escape(rankType)              +
+	", phone_number="+connection.escape(phoneNumber)           + 
+	"WHERE adult_id="+connection.escape(id);
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{
 				temp= new Adult(row[0]);
 				if(debug)
 				{console.log("UpdateAdult \n"+rows[0]+"\n");}
-				
+
 				return addScoutsToParent(temp);
 			}
 			});
 }
 
 function insertAchievement(name, description, categoryID, numElectives, connection)
 {
-	var strQuery = "INSERT INTO achievement  VALUES('"+name+"', '" +  description + "', '" + categoryID
-	+"', '"+ numElectives+ "', 'NULL')";
+	var strQuery = "INSERT INTO achievement  VALUES('"+
+	connection.escape(name)                           +"', '"+ 
+	connection.escape(description)                    +"', '"+ 
+	connection.escape(categoryID)                     +"', '"+ 
+	connection.escape(numElectives)                   +"', 'NULL')";
+	
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{
 				if(debug)
@@ -125,12 +146,16 @@ function insertAchievement(name, description, categoryID, numElectives, connecti
 			});
 }
 
 function insertCategory(name, description, rankID, numAchievments, connection)
 {
-	var strQuery = "INSERT INTO category VALUES('"+name+"', '" +  description + "', '" 
-	+ rankID+"', '"+numAchievments+ "', 'NULL')";
+	var strQuery = "INSERT INTO category VALUES('"+
+	connection.escape(name)                       +"', '"+
+	connection.escape(description)                +"', '"+ 
+	connection.escape(rankID)                     +"', '"+
+	connection.escape(numAchievments)             +"', 'NULL')";
+	
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{
 				if(debug)
@@ -140,11 +165,13 @@ function insertCategory(name, description, rankID, numAchievments, connection)
 			});
 }
 
 function insertRank(name, description, connection)
 {
-	var strQuery = "INSERT INTO rank  VALUES('"+name+"', '" +  description + "', 'NULL')";
+	var strQuery = "INSERT INTO rank  VALUES('"+
+	connection.escape(name)                    +"', '"+  
+	connection.escape(description)             +"', 'NULL')";
 
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{
@@ -156,12 +183,15 @@ function insertRank(name, description, connection)
 }
 
 function insertRecord(recordRankType, dateDone,requirementID, 
 		scoutID, connection)
 {
-	var strQuery = "INSERT INTO record  VALUES('"+recordRankType+"', '" +  
-	dateDone + "', '" +requirementID+"', '"+scoutID+"', 'NULL')";
+	var strQuery = "INSERT INTO record  VALUES('"+
+	connection.escape(recordRankType)            +"', '"+  
+	connection.escape(dateDone)                  +"', '"+
+	connection.escape(requirementID)             +"', '"+
+	connection.escape(scoutID)                   +"', 'NULL')";
 
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{
@@ -172,12 +202,16 @@ function insertRecord(recordRankType, dateDone,requirementID,
 			});
 }
 
 function insertRequirement(name, description, achievementID, reqElec, connection)
 {
-	var strQuery = "INSERT INTO requirement VALUES('"+name+"', '" +  description + 
-	"', '" + achievementID+"', '"+reqElec+ "', 'NULL')";
+	var strQuery = "INSERT INTO requirement VALUES('"+
+	connection.escape(name)                          +"', '" + 
+	connection.escape(description)                   +"', '" + 
+	connection.escape(achievementID)                 +"', '"+
+	connection.escape(reqElec)                       +"', 'NULL')";
+	
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{
 				if(debug)
@@ -188,12 +222,19 @@ function insertRequirement(name, description, achievementID, reqElec, connection
 }
 
 function insertScout(firstName, lastName, birthDate, 
 		packNumber, rankType, parentID, leaderID, connection)
 {
-	var strQuery = "INSERT INTO scout VALUES('"+firstName+"', '" +lastName+"', '"+
-	birthDate + "', '" + packNumber + "', '"+ rankType+"', '"+parentID+", "+leaderID+"', 'NULL')";
+	var strQuery = "INSERT INTO scout VALUES('"+
+	connection.escape(firstName)               +"', '"+
+	connection.escape(lastName)                +"', '"+
+	connection.escape(birthDate)               +"', '"+ 
+	connection.escape(packNumber)              +"', '"+ 
+	connection.escape(rankType)                +"', '"+
+	connection.escape(parentID)                +"', '"+
+	connection.escape(leaderID)                +"', 'NULL')";
+	
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{
 				if(debug)
@@ -202,15 +243,21 @@ function insertScout(firstName, lastName, birthDate,
 			}
 			});
 }
 
 function updateScout(firstName, lastName, birthDate,packNumber, 
-		 rankType, parentID, leaderID, scoutID, connection)
+		rankType, parentID, leaderID, scoutID, connection)
 {
-	var strQuery = "UPDATE scout SET first_name="+firstName+", last_name="+lastName+", birth_date="+
-	 + ", pack_number=" + + ", rank_type=" + packNumber+", parent_id="+
-	leaderType +", leader_id="+ rankType+" WHERE scout_id="+id;
+	var strQuery = "UPDATE scout SET "+
+	"first_name="     +connection.escape(firstName)  +
+	", last_name="    +connection.escape(lastName)   +
+	", birth_date="   +connection.escape(birthdate)  + 
+	", pack_number="  +connection.escape(packNumber) + 
+	", rank_type="    + connection.escape(rankType)  +
+	", parent_id="    +connection.escape(parentID)   +
+	", leader_id="    + connection.escape(leaderID)  +
+	" WHERE scout_id="+connection.escape(id);
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{
 				if(debug)
@@ -220,11 +267,11 @@ function updateScout(firstName, lastName, birthDate,packNumber,
 			});
 }
 
 function addScoutsToParent(adult, connection)
 {
-	var strQuery = "SELECT * FROM scout WHERE parent_id= '" +adult.rowID+"'";
+	var strQuery = "SELECT * FROM scout WHERE parent_id= '" +connection.escape(adult.rowID)+"'";
 
 	connection.query( strQuery, function(err, rows)
 			{if(err) {
 				throw err;
 			}else{

Vulnerable code: function selectAdult(username, connection)
	var strQuery = "SELECT * FROM adult WHERE username= '" +connection.escape(username)+"'";
				temp= rows[0];
				temp.password="";
				{console.log("SelectAdult \n"+rows[0]+"\n");}
				
				return temp;
function validateAdult(username, password, connection)
	var strQuery = "SELECT * FROM adult WHERE username= '" +connection.escape(username)+"'" +"AND password= '"
	+ hashPassword(password)+"'";
				
				{console.log("validateAdult \n"+rows[0]+"\n");}
				
function insertAdult(firstName, lastName, username, password, packNumber, 
		leaderType, rankType, phoneNumber, connection)
	var temp= selectAdult(username, connection);
	if(temp.databaseObject.adult_id<1)
	{
		return temp;
	}
	var strQuery = "INSERT INTO adult VALUES('"+firstName+"', '"+lastName+"', '"+
	username + "', '" +hashPassword(password) + "', '" + packNumber+"', '"+
	leaderType +"', '"+ rankType+"', '"+phoneNumber+ "', 'NULL')";
				temp= new Adult(row[0]);
				{console.log("insertAdult \n"+rows[0]+"\n");}
				
				return addScoutsToParent(temp);
	var strQuery = "UPDATE adult SET first_name="+firstName+", last_name="+lastName+", username="+
	username + ", password=" +hashPassword(password) + ", pack_number=" + packNumber+", leader_type="+
	leaderType +", rank_type="+ rankType+", phone_number="+phoneNumber+ "WHERE adult_id="+id;
				
	var strQuery = "INSERT INTO achievement  VALUES('"+name+"', '" +  description + "', '" + categoryID
	+"', '"+ numElectives+ "', 'NULL')";
	var strQuery = "INSERT INTO category VALUES('"+name+"', '" +  description + "', '" 
	+ rankID+"', '"+numAchievments+ "', 'NULL')";
	var strQuery = "INSERT INTO rank  VALUES('"+name+"', '" +  description + "', 'NULL')";
	var strQuery = "INSERT INTO record  VALUES('"+recordRankType+"', '" +  
	dateDone + "', '" +requirementID+"', '"+scoutID+"', 'NULL')";
	var strQuery = "INSERT INTO requirement VALUES('"+name+"', '" +  description + 
	"', '" + achievementID+"', '"+reqElec+ "', 'NULL')";
	var strQuery = "INSERT INTO scout VALUES('"+firstName+"', '" +lastName+"', '"+
	birthDate + "', '" + packNumber + "', '"+ rankType+"', '"+parentID+", "+leaderID+"', 'NULL')";
		 rankType, parentID, leaderID, scoutID, connection)
	var strQuery = "UPDATE scout SET first_name="+firstName+", last_name="+lastName+", birth_date="+
	 + ", pack_number=" + + ", rank_type=" + packNumber+", parent_id="+
	leaderType +", leader_id="+ rankType+" WHERE scout_id="+id;
	var strQuery = "SELECT * FROM scout WHERE parent_id= '" +adult.rowID+"'";
Fixed code: function insertAdult(firstName, lastName, username, password, packNumber, 
		leaderType, rankType, phoneNumber, connection)
	var temp= selectAdult(username, connection);

	if(temp.databaseObject.adult_id<1)
	{
		return temp;
	}
	var strQuery = "INSERT INTO adult VALUES('"+
	connection.escape(firstName)               +"', '"+
	connection.escape(lastName)                +"', '"+
	connection.escape(username)                +"', '"+
	connection.escape(hashPassword(password))  +"', '"+ 
	connection.escape(packNumber)              +"', '"+	
	connection.escape(leaderType)              +"', '"+ 
	connection.escape(rankType)                +"', '"+
	connection.escape(phoneNumber)             +"', 'NULL')";
				temp= new Adult(row[0]);
				{console.log("insertAdult \n"+rows[0]+"\n");}

				return addScoutsToParent(temp);
function selectAdult(username, connection)
	var strQuery = "SELECT * FROM adult WHERE username= '" +connection.escape(username)+"'";
				{console.log("SelectAdult \n"+rows[0]+"\n");}

function validateAdult(username, password, connection)
	var strQuery = "SELECT * FROM adult WHERE username= '" +
	connection.escape(username)+"'" +"AND password= '"     + 
	connection.escape(hashPassword(password))+"'";
				temp= rows[0];
				temp.password="";

				{console.log("validateAdult \n"+rows[0]+"\n");}

				return temp;


	var strQuery = "UPDATE adult SET "+
	"first_name="    +connection.escape(firstName)             +
	", last_name="   +connection.escape(lastName)              +
	", username="    +connection.escape(username)              + 
	", password="    +connection.escape(hashPassword(password))+ 
	", pack_number=" +connection.escape(packNumber)            +
	", leader_type=" +connection.escape(leaderType)            +
	", rank_type="   +connection.escape(rankType)              +
	", phone_number="+connection.escape(phoneNumber)           + 
	"WHERE adult_id="+connection.escape(id);

	var strQuery = "INSERT INTO achievement  VALUES('"+
	connection.escape(name)                           +"', '"+ 
	connection.escape(description)                    +"', '"+ 
	connection.escape(categoryID)                     +"', '"+ 
	connection.escape(numElectives)                   +"', 'NULL')";
	
	var strQuery = "INSERT INTO category VALUES('"+
	connection.escape(name)                       +"', '"+
	connection.escape(description)                +"', '"+ 
	connection.escape(rankID)                     +"', '"+
	connection.escape(numAchievments)             +"', 'NULL')";
	
	var strQuery = "INSERT INTO rank  VALUES('"+
	connection.escape(name)                    +"', '"+  
	connection.escape(description)             +"', 'NULL')";
	var strQuery = "INSERT INTO record  VALUES('"+
	connection.escape(recordRankType)            +"', '"+  
	connection.escape(dateDone)                  +"', '"+
	connection.escape(requirementID)             +"', '"+
	connection.escape(scoutID)                   +"', 'NULL')";
	var strQuery = "INSERT INTO requirement VALUES('"+
	connection.escape(name)                          +"', '" + 
	connection.escape(description)                   +"', '" + 
	connection.escape(achievementID)                 +"', '"+
	connection.escape(reqElec)                       +"', 'NULL')";
	
	var strQuery = "INSERT INTO scout VALUES('"+
	connection.escape(firstName)               +"', '"+
	connection.escape(lastName)                +"', '"+
	connection.escape(birthDate)               +"', '"+ 
	connection.escape(packNumber)              +"', '"+ 
	connection.escape(rankType)                +"', '"+
	connection.escape(parentID)                +"', '"+
	connection.escape(leaderID)                +"', 'NULL')";
	
		rankType, parentID, leaderID, scoutID, connection)
	var strQuery = "UPDATE scout SET "+
	"first_name="     +connection.escape(firstName)  +
	", last_name="    +connection.escape(lastName)   +
	", birth_date="   +connection.escape(birthdate)  + 
	", pack_number="  +connection.escape(packNumber) + 
	", rank_type="    + connection.escape(rankType)  +
	", parent_id="    +connection.escape(parentID)   +
	", leader_id="    + connection.escape(leaderID)  +
	" WHERE scout_id="+connection.escape(id);
	var strQuery = "SELECT * FROM scout WHERE parent_id= '" +connection.escape(adult.rowID)+"'";