CVE-2014-125046 (JavaScript, published 2023-01-06T10:15Z)
Description: value: A vulnerability, which was classified as critical, was found in Seiji42 cub-scout-tracker. This affects an unknown part of the file databaseAccessFunctions.js. The manipulation leads to sql injection. The patch is named b4bc1a328b1f59437db159f9d136d9ed15707e31. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217551.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Seiji42/cub-scout-tracker
Files changed:
databaseAccessFunctions.js
Commit message: Added protection from sql injection and dubug flag


Vulnerable code:
function selectAdult(username, connection)
	var strQuery = "SELECT * FROM adult WHERE username= '" +connection.escape(username)+"'";
				temp= rows[0];
				temp.password="";
				{console.log("SelectAdult \n"+rows[0]+"\n");}
				
				return temp;
function validateAdult(username, password, connection)
	var strQuery = "SELECT * FROM adult WHERE username= '" +connection.escape(username)+"'" +"AND password= '"
	+ hashPassword(password)+"'";
				
				{console.log("validateAdult \n"+rows[0]+"\n");}
				
function insertAdult(firstName, lastName, username, password, packNumber, 
		leaderType, rankType, phoneNumber, connection)
	var temp= selectAdult(username, connection);
	if(temp.databaseObject.adult_id<1)
	{
		return temp;
	}
	var strQuery = "INSERT INTO adult VALUES('"+firstName+"', '"+lastName+"', '"+
	username + "', '" +hashPassword(password) + "', '" + packNumber+"', '"+
	leaderType +"', '"+ rankType+"', '"+phoneNumber+ "', 'NULL')";
				temp= new Adult(row[0]);
				{console.log("insertAdult \n"+rows[0]+"\n");}
				
				return addScoutsToParent(temp);
	var strQuery = "UPDATE adult SET first_name="+firstName+", last_name="+lastName+", username="+
	username + ", password=" +hashPassword(password) + ", pack_number=" + packNumber+", leader_type="+
	leaderType +", rank_type="+ rankType+", phone_number="+phoneNumber+ "WHERE adult_id="+id;
				
	var strQuery = "INSERT INTO achievement  VALUES('"+name+"', '" +  description + "', '" + categoryID
	+"', '"+ numElectives+ "', 'NULL')";
	var strQuery = "INSERT INTO category VALUES('"+name+"', '" +  description + "', '" 
	+ rankID+"', '"+numAchievments+ "', 'NULL')";
	var strQuery = "INSERT INTO rank  VALUES('"+name+"', '" +  description + "', 'NULL')";
	var strQuery = "INSERT INTO record  VALUES('"+recordRankType+"', '" +  
	dateDone + "', '" +requirementID+"', '"+scoutID+"', 'NULL')";
	var strQuery = "INSERT INTO requirement VALUES('"+name+"', '" +  description + 
	"', '" + achievementID+"', '"+reqElec+ "', 'NULL')";
	var strQuery = "INSERT INTO scout VALUES('"+firstName+"', '" +lastName+"', '"+
	birthDate + "', '" + packNumber + "', '"+ rankType+"', '"+parentID+", "+leaderID+"', 'NULL')";
		 rankType, parentID, leaderID, scoutID, connection)
	var strQuery = "UPDATE scout SET first_name="+firstName+", last_name="+lastName+", birth_date="+
	 + ", pack_number=" + + ", rank_type=" + packNumber+", parent_id="+
	leaderType +", leader_id="+ rankType+" WHERE scout_id="+id;
	var strQuery = "SELECT * FROM scout WHERE parent_id= '" +adult.rowID+"'";

Fixed code:
function insertAdult(firstName, lastName, username, password, packNumber, 
		leaderType, rankType, phoneNumber, connection)
	var temp= selectAdult(username, connection);

	if(temp.databaseObject.adult_id<1)
	{
		return temp;
	}
	var strQuery = "INSERT INTO adult VALUES('"+
	connection.escape(firstName)               +"', '"+
	connection.escape(lastName)                +"', '"+
	connection.escape(username)                +"', '"+
	connection.escape(hashPassword(password))  +"', '"+ 
	connection.escape(packNumber)              +"', '"+	
	connection.escape(leaderType)              +"', '"+ 
	connection.escape(rankType)                +"', '"+
	connection.escape(phoneNumber)             +"', 'NULL')";
				temp= new Adult(row[0]);
				{console.log("insertAdult \n"+rows[0]+"\n");}

				return addScoutsToParent(temp);
function selectAdult(username, connection)
	var strQuery = "SELECT * FROM adult WHERE username= '" +connection.escape(username)+"'";
				{console.log("SelectAdult \n"+rows[0]+"\n");}

function validateAdult(username, password, connection)
	var strQuery = "SELECT * FROM adult WHERE username= '" +
	connection.escape(username)+"'" +"AND password= '"     + 
	connection.escape(hashPassword(password))+"'";
				temp= rows[0];
				temp.password="";

				{console.log("validateAdult \n"+rows[0]+"\n");}

				return temp;


	var strQuery = "UPDATE adult SET "+
	"first_name="    +connection.escape(firstName)             +
	", last_name="   +connection.escape(lastName)              +
	", username="    +connection.escape(username)              + 
	", password="    +connection.escape(hashPassword(password))+ 
	", pack_number=" +connection.escape(packNumber)            +
	", leader_type=" +connection.escape(leaderType)            +
	", rank_type="   +connection.escape(rankType)              +
	", phone_number="+connection.escape(phoneNumber)           + 
	"WHERE adult_id="+connection.escape(id);

	var strQuery = "INSERT INTO achievement  VALUES('"+
	connection.escape(name)                           +"', '"+ 
	connection.escape(description)                    +"', '"+ 
	connection.escape(categoryID)                     +"', '"+ 
	connection.escape(numElectives)                   +"', 'NULL')";
	
	var strQuery = "INSERT INTO category VALUES('"+
	connection.escape(name)                       +"', '"+
	connection.escape(description)                +"', '"+ 
	connection.escape(rankID)                     +"', '"+
	connection.escape(numAchievments)             +"', 'NULL')";
	
	var strQuery = "INSERT INTO rank  VALUES('"+
	connection.escape(name)                    +"', '"+  
	connection.escape(description)             +"', 'NULL')";
	var strQuery = "INSERT INTO record  VALUES('"+
	connection.escape(recordRankType)            +"', '"+  
	connection.escape(dateDone)                  +"', '"+
	connection.escape(requirementID)             +"', '"+
	connection.escape(scoutID)                   +"', 'NULL')";
	var strQuery = "INSERT INTO requirement VALUES('"+
	connection.escape(name)                          +"', '" + 
	connection.escape(description)                   +"', '" + 
	connection.escape(achievementID)                 +"', '"+
	connection.escape(reqElec)                       +"', 'NULL')";
	
	var strQuery = "INSERT INTO scout VALUES('"+
	connection.escape(firstName)               +"', '"+
	connection.escape(lastName)                +"', '"+
	connection.escape(birthDate)               +"', '"+ 
	connection.escape(packNumber)              +"', '"+ 
	connection.escape(rankType)                +"', '"+
	connection.escape(parentID)                +"', '"+
	connection.escape(leaderID)                +"', 'NULL')";
	
		rankType, parentID, leaderID, scoutID, connection)
	var strQuery = "UPDATE scout SET "+
	"first_name="     +connection.escape(firstName)  +
	", last_name="    +connection.escape(lastName)   +
	", birth_date="   +connection.escape(birthdate)  + 
	", pack_number="  +connection.escape(packNumber) + 
	", rank_type="    + connection.escape(rankType)  +
	", parent_id="    +connection.escape(parentID)   +
	", leader_id="    + connection.escape(leaderID)  +
	" WHERE scout_id="+connection.escape(id);
	var strQuery = "SELECT * FROM scout WHERE parent_id= '" +connection.escape(adult.rowID)+"'";