CVE-2015-10068: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability classified as critical was found in danynab movify-j. This vulnerability affects the function getByMovieId of the file app/business/impl/ReviewServiceImpl.java. The manipulation of the argument movieId/username leads to sql injection. The name of the patch is c3085e01936a4d7eff1eda3093f25d56cc4d2ec5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218476.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-18T08:15Z
Repository: https://github.com/danynab/movify-j
Language: Java
Files changed: app/business/impl/ReviewServiceImpl.java, app/controllers/WebplayerController.java
Commit date: 2015-03-14 18:09:36 +0100
Commit message: Avoid SQL Injection

Diff: diff --git a/app/business/impl/ReviewServiceImpl.java b/app/business/impl/ReviewServiceImpl.java
index 0185f7c..685b2cf 100644
--- a/app/business/impl/ReviewServiceImpl.java
+++ b/app/business/impl/ReviewServiceImpl.java
@@ -1,8 +1,9 @@
 package business.impl;
 
 import business.ReviewService;
+import com.avaje.ebean.Expr;
 import models.Review;
 import play.db.ebean.Model;
 
 import java.util.List;
 
@@ -20,11 +21,11 @@ public class ReviewServiceImpl implements ReviewService {
         return find.where().eq("movieId", movieId).findList();
     }
 
     @Override
     public Review getByMovieIdAndUsername(int movieId, String username) {
-        return find.where("movieId = " + movieId + " and username = '" + username + "'").findUnique();
+        return find.where().and(Expr.eq("movieId", movieId), Expr.eq("username", username)).findUnique();
     }
 
     @Override
     public Review rateMovie(String username, int movieId, String comment, double rating) {
         Review review = new Review(username, movieId, comment, rating);
diff --git a/app/controllers/WebplayerController.java b/app/controllers/WebplayerController.java
index 9587e3d..d2d6ff0 100644
--- a/app/controllers/WebplayerController.java
+++ b/app/controllers/WebplayerController.java
@@ -1,8 +1,9 @@
 package controllers;
 
 import filters.LoginRequiredAction;
+import filters.SubscriptionRequiredAction;
 import infrastructure.Factories;
 import models.Genre;
 import models.Movie;
 import models.Review;
 import org.apache.commons.lang3.StringEscapeUtils;
@@ -17,12 +18,11 @@ import views.html.webplayer;
 import java.util.List;
 
 /**
  * Created by Dani on 14/3/15.
  */
-@With(LoginRequiredAction.class)
-//@With({LoginRequiredAction.class, SubscriptionRequiredAction.class})
+@With({LoginRequiredAction.class, SubscriptionRequiredAction.class})
 public class WebplayerController extends Controller {
 
     public static Result showWebplayer() {
         List<Movie> randomMovies = Factories.businessFactory.getMovieService().getRandom(6);
         List<Movie> allMovies = Factories.businessFactory.getMovieService().getAll();

Vulnerable code:         return find.where("movieId = " + movieId + " and username = '" + username + "'").findUnique();
@With(LoginRequiredAction.class)
//@With({LoginRequiredAction.class, SubscriptionRequiredAction.class})
Fixed code: import com.avaje.ebean.Expr;
        return find.where().and(Expr.eq("movieId", movieId), Expr.eq("username", username)).findUnique();
import filters.SubscriptionRequiredAction;
@With({LoginRequiredAction.class, SubscriptionRequiredAction.class})