CVE-2014-125082: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in nivit redports. It has been declared as critical. This vulnerability affects unknown code of the file redports-trac/redports/model.py. The manipulation leads to sql injection. The name of the patch is fc2c1ea1b8d795094abb15ac73cab90830534e04. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218464.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-18T00:15Z
Repository: https://github.com/nivit/redports
Language: Python
Files changed: redports-trac/redports/model.py
Commit date: 2014-01-14 16:22:47 +0000
Commit message: redports-trac:
- Fix a possible SQL injection

Diff: diff --git a/redports-trac/redports/model.py b/redports-trac/redports/model.py
index bb378f9..ef459c1 100644
--- a/redports-trac/redports/model.py
+++ b/redports-trac/redports/model.py
@@ -755,11 +755,11 @@ class BuildarchiveIterator(object):
         self.env = env
 
     def filter(self, owner=None, queueid=None, revision=None, uniqueports=False):
         self.owner = owner
         self.queueid = queueid
-	self.revision = int(revision)
+	self.revision = revision
         self.uniqueports = uniqueports
 
     def count(self):
         cursor = self.env.get_db_cnx().cursor()
         cursor.execute("SELECT count(*) FROM buildqueue WHERE status >= 90" + self._get_filter())
@@ -770,17 +770,17 @@ class BuildarchiveIterator(object):
 
     def _get_filter(self):
         filter = ''
 
         if self.queueid:
-            filter += "AND buildqueue.id = '%s'" % (self.queueid)
+            filter += "AND buildqueue.id = '%s'" % (re.sub("[\"']", "", self.queueid))
 
         if self.owner:
-            filter += "AND buildqueue.owner = '%s'" % (self.owner)
+            filter += "AND buildqueue.owner = '%s'" % (re.sub("[\"']", "", self.owner))
 
 	if self.revision:
-            filter += "AND buildqueue.revision = '%s'" % (self.revision)
+            filter += "AND buildqueue.revision = %s" % (int(self.revision))
 
         return filter
 
     def get_data(self, limit=100, offset=0):
         cursor = self.env.get_db_cnx().cursor()

Vulnerable code: 	self.revision = int(revision)
            filter += "AND buildqueue.id = '%s'" % (self.queueid)
            filter += "AND buildqueue.owner = '%s'" % (self.owner)
            filter += "AND buildqueue.revision = '%s'" % (self.revision)
Fixed code: 	self.revision = revision
            filter += "AND buildqueue.id = '%s'" % (re.sub("[\"']", "", self.queueid))
            filter += "AND buildqueue.owner = '%s'" % (re.sub("[\"']", "", self.owner))
            filter += "AND buildqueue.revision = %s" % (int(self.revision))