CVE-2015-10035: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in gperson angular-test-reporter and classified as critical. This issue affects the function getProjectTables/addTest of the file rest-server/data-server.js. The manipulation leads to sql injection. The patch is named a29d8ae121b46ebfa96a55a9106466ab2ef166ae. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217715.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-09T21:15Z
Repository: https://github.com/gperson/angular-test-reporter
Language: JavaScript
Files changed: app/app.js, rest-server/data-server.js
Commit date: 2015-01-07 21:30:05 -0600
Commit message: Escaping to prevent sql injections & others issues

Diff: diff --git a/app/app.js b/app/app.js
index fdcd1df..d8dac0e 100644
--- a/app/app.js
+++ b/app/app.js
@@ -28,11 +28,11 @@ app.controller('projectCtrl', function($scope, $location, $http, myFactory) {
 	};
 	
 	$scope.switchProject = function(project){
 		myFactory.set(project);
 		$scope.project.name = project.substring(6);
-		$location.path('/app/index.html#/view1');
+		$location.path('/app/index.html#/tests');
 	};
 });
 
 app.factory('myFactory', function() {
 	var savedData = {};
diff --git a/rest-server/data-server.js b/rest-server/data-server.js
index 151ee77..68dfdc2 100644
--- a/rest-server/data-server.js
+++ b/rest-server/data-server.js
@@ -133,11 +133,12 @@ function getProjectTables(response){
  * @param response The response to send back
  * @param note Note object to add
  */
 function addNote(request, response, note){
 	var parts = url.parse(request.url,true);
-	var query = connection.query("INSERT INTO notes_"+(parts.query.table).substring(6)+" (testId,who,note) VALUES ("+note.testId+",'" + note.who + "','"+note.note+"')", function(err, rows, fields) {
+	var queryStr = "INSERT INTO notes_"+(parts.query.table).substring(6)+" (testId,who,note) VALUES ("+connection.escape(note.testId)+"," + connection.escape(note.who) + ","+connection.escape(note.note)+")";
+	var query = connection.query(queryStr,function(err, rows, fields) {
 		if (err) {
 			response.statusCode = 400;
 			console.log(err);
 		} 
 	});
@@ -161,11 +162,11 @@ function addTest(request, response, body){
 
 	//Format to YYYY-MM-DD HH:MM:SS
 	start = start.getFullYear()+"-"+(start.getMonth()+1)+"-"+start.getDate()+" "+start.getHours()+":"+start.getMinutes()+":"+start.getSeconds();
 	end = end.getFullYear()+"-"+(end.getMonth()+1)+"-"+end.getDate()+" "+end.getHours()+":"+end.getMinutes()+":"+end.getSeconds();
 
-	var queryStr = "INSERT INTO "+table+" (name,param,error,start,end,status,extra,runInfo) VALUES ('"+test.name+"','" + test.param + "','"+test.error+ "','"+start+ "','"+end+ "','"+test.status+ "','"+test.extra+ "','"+test.runInfo+"')";
+	var queryStr = "INSERT INTO "+table+" (name,param,error,start,end,status,extra,runInfo) VALUES ("+connection.escape(test.name)+"','" + connection.escape(test.param) + ","+connection.escape(test.error)+ "','"+start+ "','"+end+ "',"+connection.escape(test.status)+ ","+connection.escape(test.extra)+ ","+connection.escape(test.runInfo)+")";
 	var query = connection.query(queryStr, function(err, rows, fields) {
 		if (err) {
 			response.statusCode = 400;
 			console.log(err);
 		} 

Vulnerable code: 		$location.path('/app/index.html#/view1');
	var query = connection.query("INSERT INTO notes_"+(parts.query.table).substring(6)+" (testId,who,note) VALUES ("+note.testId+",'" + note.who + "','"+note.note+"')", function(err, rows, fields) {
	var queryStr = "INSERT INTO "+table+" (name,param,error,start,end,status,extra,runInfo) VALUES ('"+test.name+"','" + test.param + "','"+test.error+ "','"+start+ "','"+end+ "','"+test.status+ "','"+test.extra+ "','"+test.runInfo+"')";
Fixed code: 		$location.path('/app/index.html#/tests');
	var queryStr = "INSERT INTO notes_"+(parts.query.table).substring(6)+" (testId,who,note) VALUES ("+connection.escape(note.testId)+"," + connection.escape(note.who) + ","+connection.escape(note.note)+")";
	var query = connection.query(queryStr,function(err, rows, fields) {
	var queryStr = "INSERT INTO "+table+" (name,param,error,start,end,status,extra,runInfo) VALUES ("+connection.escape(test.name)+"','" + connection.escape(test.param) + ","+connection.escape(test.error)+ "','"+start+ "','"+end+ "',"+connection.escape(test.status)+ ","+connection.escape(test.extra)+ ","+connection.escape(test.runInfo)+")";