CVE-2015-10056: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in 2071174A vinylmap. It has been classified as critical. Affected is the function contact of the file recordstoreapp/views.py. The manipulation leads to sql injection. The name of the patch is b07b79a1e92cc62574ba0492cce000ef4a7bd25f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218400.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-16T19:15Z
Repository: https://github.com/2071174A/vinylmap
Language: Other
Files changed: README, recordstoreapp/views.py
Commit date: 2015-03-23 18:26:17 +0000
Commit message: fixed SQL injection vuln in unsanitized search input

shame on you tony

Diff: diff --git a/README b/README
index 84ba01f..eff7ced 100644
--- a/README
+++ b/README
@@ -1,5 +1,4 @@
 #TODO: README file.
 #TODO: automated tests from the book.
 #TODO: a non-crawler population script.
 #TODO: update specifications to match the project
-#TODO: unsanitized search input
diff --git a/recordstoreapp/views.py b/recordstoreapp/views.py
index 8d9e0e2..914433f 100644
--- a/recordstoreapp/views.py
+++ b/recordstoreapp/views.py
@@ -22,16 +22,18 @@ def contact(request):
 	context_dict = {}
 	return render(request, 'contact.html', context_dict)
 
 def search(request):
 	context_dict = {}
-	if 'q' in request.GET and request.GET['q'] != '':
-		q = request.GET['q']
+	q = request.GET['q'].replace('%', '').replace('_', '').strip()
+	if 'q' in request.GET and q != '':
+		q = '%' + q + '%'
 		cursor = connection.cursor()
-		cursor.execute("SELECT id,title,artist,cover FROM recordstoreapp_record WHERE title like '%" + q + "%' or artist like '%" + q + "%' or label like '%" + q + "%' or cat_no like '%" + q + "%';")
+		cursor.execute("SELECT id,title,artist,cover FROM recordstoreapp_record WHERE title like %s or artist like %s or label like %s or cat_no like %s;", [q,q,q,q])
 		rec_list=cursor.fetchall()
 		
+
 		total=len(rec_list)
 		pg=int(request.GET['page']) if 'page' in request.GET else 1
 		ub=min(pg*12, total)
 
 		context_dict['rec_list'] = rec_list[(pg-1)*12:ub]
diff --git a/recordstoreapp/views.pyc b/recordstoreapp/views.pyc
index ee59a32..857b665 100644
Binary files a/recordstoreapp/views.pyc and b/recordstoreapp/views.pyc differ

Vulnerable code: #TODO: unsanitized search input
	if 'q' in request.GET and request.GET['q'] != '':
		q = request.GET['q']
		cursor.execute("SELECT id,title,artist,cover FROM recordstoreapp_record WHERE title like '%" + q + "%' or artist like '%" + q + "%' or label like '%" + q + "%' or cat_no like '%" + q + "%';")
Fixed code: 	q = request.GET['q'].replace('%', '').replace('_', '').strip()
	if 'q' in request.GET and q != '':
		q = '%' + q + '%'
		cursor.execute("SELECT id,title,artist,cover FROM recordstoreapp_record WHERE title like %s or artist like %s or label like %s or cat_no like %s;", [q,q,q,q])