CVE-2015-5659: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in Network Applied Communication Laboratory Pref Shimane CMS 2.x before 2.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-10-11T01:59Z
Repository: https://github.com/NaCl-Ltd/pref-shimane-cms
Language: Ruby
Files changed: pref-shimane-cms/CHANGELOG.md, pref-shimane-cms/app/controllers/concerns/susanoo/pages_controller.rb, pref-shimane-cms/config/initializers/version.rb
Commit date: 2015-10-07 13:13:11 +0900
Commit message: SQLインジェクションにより、情報を不正取得できてしまう不具合を修正

Diff: diff --git a/pref-shimane-cms/CHANGELOG.md b/pref-shimane-cms/CHANGELOG.md
new file mode 100644
index 0000000..4eb0b0c
--- /dev/null
+++ b/pref-shimane-cms/CHANGELOG.md
@@ -0,0 +1,11 @@
+# Changelog
+
+## Version 2.0.1 (2015/10/7)
+
+* Bugfix
+
+  * SQLインジェクションにより、情報を不正取得できてしまう不具合を修正
+
+## Version 2.0.0 (2014/9/6)
+
+* 初期リリース
\ No newline at end of file
diff --git a/pref-shimane-cms/app/controllers/concerns/susanoo/pages_controller.rb b/pref-shimane-cms/app/controllers/concerns/susanoo/pages_controller.rb
index 7850dfe..79c8e07 100644
--- a/pref-shimane-cms/app/controllers/concerns/susanoo/pages_controller.rb
+++ b/pref-shimane-cms/app/controllers/concerns/susanoo/pages_controller.rb
@@ -252,11 +252,10 @@ module Concerns::Susanoo::PagesController
           attr[:order_column] ||= 'pages.name'
           attr[:order_direction] ||= 'ASC'
           super
         end
 
-
         #
         #=== 検索を実施する
         #
         def search(user, genre)
           order = order_by
@@ -276,9 +275,45 @@ module Concerns::Susanoo::PagesController
             true
           else
             false
           end
         end
+
+        #
+        #=== ソート順を返す
+        #
+        def order_by
+          order_option = ''
+          if valid_order_params?
+            direction = self.order_direction || 'ASC'
+            order_option = "#{self.order_column} #{direction}"
+          end
+          order_option.present? ? order_option : @@default_order
+        end
+
+        #
+        #=== ソートパラメータを検証する
+        #
+        def valid_order_params?
+          if self.order_column.blank?
+            return false
+          end
+
+          permit_column_params = ['pages.name', 'page_contents.last_modified']
+          permit_dir_params = ['ASC', 'DESC']
+
+          unless permit_column_params.include?(self.order_column)
+            return false
+          end
+
+          if self.order_direction.present? &&
+            !permit_dir_params.include?(self.order_direction.upcase)
+            return false
+          end
+
+          return true
+        end
       end
+
   end
 end
 
diff --git a/pref-shimane-cms/config/initializers/version.rb b/pref-shimane-cms/config/initializers/version.rb
index cf364a6..23cc027 100644
--- a/pref-shimane-cms/config/initializers/version.rb
+++ b/pref-shimane-cms/config/initializers/version.rb
@@ -1,5 +1,5 @@
 module PrefShimaneCms
   class Application
-    VERSION = '2.0.0'
+    VERSION = '2.0.1'
   end
 end

Vulnerable code: 
    VERSION = '2.0.0'
Fixed code: # Changelog

## Version 2.0.1 (2015/10/7)

* Bugfix

  * SQLインジェクションにより、情報を不正取得できてしまう不具合を修正

## Version 2.0.0 (2014/9/6)

* 初期リリース

        #
        #=== ソート順を返す
        #
        def order_by
          order_option = ''
          if valid_order_params?
            direction = self.order_direction || 'ASC'
            order_option = "#{self.order_column} #{direction}"
          end
          order_option.present? ? order_option : @@default_order
        end

        #
        #=== ソートパラメータを検証する
        #
        def valid_order_params?
          if self.order_column.blank?
            return false
          end

          permit_column_params = ['pages.name', 'page_contents.last_modified']
          permit_dir_params = ['ASC', 'DESC']

          unless permit_column_params.include?(self.order_column)
            return false
          end

          if self.order_direction.present? &&
            !permit_dir_params.include?(self.order_direction.upcase)
            return false
          end

          return true
        end

    VERSION = '2.0.1'