CVE-2015-10023: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability classified as critical has been found in Fumon trello-octometric. This affects the function main of the file metrics-ui/server/srv.go. The manipulation of the argument num leads to sql injection. The patch is named a1f1754933fbf21e2221fbc671c81a47de6a04ef. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217611.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-07T12:15Z
Repository: https://github.com/Fumon/trello-octometric
Language: Go
Files changed: metrics-ui/server/srv.go
Commit date: 2015-01-25 13:04:04 -0500
Commit message: Fixed sql injection

Diff: diff --git a/metrics-ui/server/srv.go b/metrics-ui/server/srv.go
index b20289d..a4fe13a 100644
--- a/metrics-ui/server/srv.go
+++ b/metrics-ui/server/srv.go
@@ -53,12 +53,12 @@ func main() {
 		// Grab vars
 		vars := mux.Vars(r)
 
 		var output string
 		// This is bad... don't do this.... omg
-		query := fmt.Sprintf(`SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, end_of_day_total from trello.dailytallies order by day DESC limit %s) r;`, vars["num"])
-		err := db.QueryRow(query).Scan(&output)
+		query := `SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, end_of_day_total from trello.dailytallies order by day DESC limit $1) r;`
+		err := db.QueryRow(query, vars["num"]).Scan(&output)
 
 		if err != nil {
 			log.Println("Error retriving from DB, ", err)
 			w.WriteHeader(http.StatusInternalServerError)
 			fmt.Fprintln(w, "Error retriving from DB, ", err)
@@ -74,12 +74,12 @@ func main() {
 		// Grab vars
 		vars := mux.Vars(r)
 
 		var output string
 		// This is bad... don't do this.... omg
-		query := fmt.Sprintf(`SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, up_count, down_count, finished_count from trello.dailytallies order by day DESC limit %s) r;`, vars["num"])
-		err := db.QueryRow(query).Scan(&output)
+		query := `SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, up_count, down_count, finished_count from trello.dailytallies order by day DESC limit $1) r;`
+		err := db.QueryRow(query, vars["num"]).Scan(&output)
 
 		if err != nil {
 			log.Println("Error retriving from DB, ", err)
 			w.WriteHeader(http.StatusInternalServerError)
 			fmt.Fprintln(w, "Error retriving from DB, ", err)

Vulnerable code: 		query := fmt.Sprintf(`SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, end_of_day_total from trello.dailytallies order by day DESC limit %s) r;`, vars["num"])
		err := db.QueryRow(query).Scan(&output)
		query := fmt.Sprintf(`SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, up_count, down_count, finished_count from trello.dailytallies order by day DESC limit %s) r;`, vars["num"])
		err := db.QueryRow(query).Scan(&output)
Fixed code: 		query := `SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, end_of_day_total from trello.dailytallies order by day DESC limit $1) r;`
		err := db.QueryRow(query, vars["num"]).Scan(&output)
		query := `SELECT json_agg(r) FROM (select EXTRACT(epoch FROM day) as day, up_count, down_count, finished_count from trello.dailytallies order by day DESC limit $1) r;`
		err := db.QueryRow(query, vars["num"]).Scan(&output)