CVE-2015-2972: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-07-19T15:59Z
Repository: https://github.com/sysphonic/thetis
Language: Ruby
Files changed: app/controllers/equipment_controller.rb, app/controllers/groups_controller.rb
Commit date: 2015-07-04 09:40:26 +0900
Commit message: x ApplicationHelper.get_sql_like() -> o SqlHelper.get_sql_like()
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>

Diff: diff --git a/app/controllers/equipment_controller.rb b/app/controllers/equipment_controller.rb
index dc9e438b..dc219665 100644
--- a/app/controllers/equipment_controller.rb
+++ b/app/controllers/equipment_controller.rb
@@ -141,11 +141,11 @@ class EquipmentController < ApplicationController
     end
     unless @group_id.nil?
       if @group_id == '0'
         con << "((groups like '%|0|%') or (groups is null))"
       else
-        con << ApplicationHelper.get_sql_like([:groups], "|#{@group_id}|")
+        con << SqlHelper.get_sql_like([:groups], "|#{@group_id}|")
       end
     end
 
     where = ''
     unless con.empty?
@@ -217,15 +217,15 @@ class EquipmentController < ApplicationController
       display_id = params[:display].split('_').last
 
       case display_type
        when 'group'
         if @login_user.get_groups_a(true).include?(display_id)
-          con = ApplicationHelper.get_sql_like([:groups], "|#{display_id}|")
+          con = SqlHelper.get_sql_like([:groups], "|#{display_id}|")
         end
        when 'team'
         if @login_user.get_teams_a.include?(display_id)
-          con = ApplicationHelper.get_sql_like([:teams], "|#{display_id}|")
+          con = SqlHelper.get_sql_like([:teams], "|#{display_id}|")
         end
       end
     end
 
     return if con.nil?
diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index 3fd81e50..7dc095f2 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -261,11 +261,11 @@ class GroupsController < ApplicationController
 
     unless @group_id.nil?
       if @group_id == '0'
         con << "((groups like '%|0|%') or (groups is null))"
       else
-        con << ApplicationHelper.get_sql_like([:groups], "|#{@group_id}|")
+        con << SqlHelper.get_sql_like([:groups], "|#{@group_id}|")
       end
     end
 
     unless params[:keyword].blank?
       key_array = params[:keyword].split(nil)

Vulnerable code:         con << ApplicationHelper.get_sql_like([:groups], "|#{@group_id}|")
          con = ApplicationHelper.get_sql_like([:groups], "|#{display_id}|")
          con = ApplicationHelper.get_sql_like([:teams], "|#{display_id}|")
        con << ApplicationHelper.get_sql_like([:groups], "|#{@group_id}|")
Fixed code:         con << SqlHelper.get_sql_like([:groups], "|#{@group_id}|")
          con = SqlHelper.get_sql_like([:groups], "|#{display_id}|")
          con = SqlHelper.get_sql_like([:teams], "|#{display_id}|")
        con << SqlHelper.get_sql_like([:groups], "|#{@group_id}|")