CVE-2014-125038: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability has been found in IS_Projecto2 and classified as critical. This vulnerability affects unknown code of the file Cnn-EJB/ejbModule/ejbs/NewsBean.java. The manipulation of the argument date leads to sql injection. The name of the patch is aa128b2c9c9fdcbbf5ecd82c1e92103573017fe0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217192.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-02T18:15Z
Repository: https://github.com/rfsimoes/IS_Projecto2
Language: Other
Files changed: Cnn-EJB/ejbModule/ejbs/NewsBean.java, Cnn-Web/WebContent/AllNews.jsp, Cnn-Web/WebContent/DateNews.jsp, Cnn-Web/WebContent/Menu.jsp
Commit date: 2014-11-12 14:48:28 +0000
Commit message: data a funcionar mas sem proteger sql injection

Diff: diff --git a/Cnn-EJB/ejbModule/ejbs/NewsBean.java b/Cnn-EJB/ejbModule/ejbs/NewsBean.java
index dc958d6..a8fc7c2 100644
--- a/Cnn-EJB/ejbModule/ejbs/NewsBean.java
+++ b/Cnn-EJB/ejbModule/ejbs/NewsBean.java
@@ -91,23 +91,23 @@ public class NewsBean implements NewsBeanRemote {
      * Método para ir buscar as notícias mais recentes que uma data
      * @param date
      * @return lista de notícias ordenadas
      */
     public List<News> newsMoreRecentThan(String date){
-    	Query query = em.createQuery("SELECT n FROM News n WHERE n.date > :d ORDER BY date DESC");
-    	query.setParameter("d", date);
+    	Query query = em.createQuery("SELECT n FROM News n WHERE n.date > '"+date+"' ORDER BY date DESC");
+    	//query.setParameter("d", date);
     	
     	@SuppressWarnings("unchecked")
 		List<News> news = query.getResultList();
     	
 		return news;
     }
     
     public List<News> newsMoreRecentThan(String date, String region){
-    	Query query = em.createQuery("SELECT n FROM News n WHERE n.region LIKE :r AND n.date > :d ORDER BY date DESC");
+    	Query query = em.createQuery("SELECT n FROM News n WHERE n.region LIKE :r AND n.date > '"+date+"' ORDER BY date DESC");
     	query.setParameter("r", region);
-    	query.setParameter("d", date);
+    	//query.setParameter("d", date);
     	
     	@SuppressWarnings("unchecked")
 		List<News> news = query.getResultList();
     	
 		return news;
diff --git a/Cnn-Web/WebContent/AllNews.jsp b/Cnn-Web/WebContent/AllNews.jsp
index 773c566..2e43278 100644
--- a/Cnn-Web/WebContent/AllNews.jsp
+++ b/Cnn-Web/WebContent/AllNews.jsp
@@ -111,13 +111,10 @@
 							</div>
 							<div id="collapse${news.region}${status.index}" class="panel-collapse collapse">
 								<div class="panel-body">
 									<!-- Autor(es) -->
 									<!-- 
-									<c:set var="string2" value="This is second String."/>
-									<c:set var="numAuthors" value="${fn:length(string2)}"/>
-									<p>Length of String (2) : ${numAuthors}</p>
 									
 							  		<c:if test="${numAuthors > 0}">
  							  			by 
 								  		<c:choose>
 											<c:when test="${numAuthors==1}">
@@ -129,11 +126,11 @@
 											<c:otherwise>
 												<b><c:out value="${news.authors[0]}"/></b>, <b><c:out value="${news.authors[1]}"/></b> and <b>c:out value="${news.authors[2]}"/></b>,
 											</c:otherwise>
 										</c:choose>
 									</c:if>
-									 -->
+									-->
 									<!-- Data -->
  									on 
  									<fmt:formatDate pattern="yyyy/MM/dd HH:mm" value="${news.date}" />
 									<br><br>
 									<!-- Highlights -->
diff --git a/Cnn-Web/WebContent/DateNews.jsp b/Cnn-Web/WebContent/DateNews.jsp
index d2970c9..ad9ccab 100644
--- a/Cnn-Web/WebContent/DateNews.jsp
+++ b/Cnn-Web/WebContent/DateNews.jsp
@@ -52,10 +52,11 @@
 			</div>
 		</nav>
 		
 		<% 
 			String date = session.getAttribute("date").toString();
+			//System.out.println("DATA: " + date);
 		%>
 		<h1>News more recent than <%= date %></h1>
 		
 		<%  
         	NewsBeanRemote newsbean = (NewsBeanRemote) session.getAttribute("newsBean");
diff --git a/Cnn-Web/WebContent/Menu.jsp b/Cnn-Web/WebContent/Menu.jsp
index fa76a75..666198c 100644
--- a/Cnn-Web/WebContent/Menu.jsp
+++ b/Cnn-Web/WebContent/Menu.jsp
@@ -110,11 +110,11 @@
 				</p>
 		</form>
         
         <form action="DateNewsServlet" method="GET" id="login_form" onsubmit="return validateForm('date')">
 				<p>
-					List news more recent than <input type="text" name="date" id="date" />
+					List news more recent than <input type="datetime-local" name="date" id="date" />
 					<input type="SUBMIT" value="Ok" />
 				</p>
 		</form>
         
 		<form action="HighlightNewsServlet" method="POST" id="login_form" onsubmit="return validateForm('word')">

Vulnerable code:     	Query query = em.createQuery("SELECT n FROM News n WHERE n.date > :d ORDER BY date DESC");
    	query.setParameter("d", date);
    	Query query = em.createQuery("SELECT n FROM News n WHERE n.region LIKE :r AND n.date > :d ORDER BY date DESC");
    	query.setParameter("d", date);
									<c:set var="string2" value="This is second String."/>
									<c:set var="numAuthors" value="${fn:length(string2)}"/>
									<p>Length of String (2) : ${numAuthors}</p>
									 -->
					List news more recent than <input type="text" name="date" id="date" />
Fixed code:     	Query query = em.createQuery("SELECT n FROM News n WHERE n.date > '"+date+"' ORDER BY date DESC");
    	//query.setParameter("d", date);
    	Query query = em.createQuery("SELECT n FROM News n WHERE n.region LIKE :r AND n.date > '"+date+"' ORDER BY date DESC");
    	//query.setParameter("d", date);
									-->
			//System.out.println("DATA: " + date);
					List news more recent than <input type="datetime-local" name="date" id="date" />