CVE-2017-17713 (Python, published 2017-12-16T20:29Z)
Description: value: Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header, the /register country parameter, the /register countryCode parameter, the /register cpu parameter, the /register isp parameter, the /register lat parameter, the /register lon parameter, the /register org parameter, the /register query parameter, the /register region parameter, the /register regionName parameter, the /register timezone parameter, the /register vId parameter, the /register zip parameter, or the /tping id parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/boxug/trape
Files changed:
core/db.py
core/stats.py
core/victim.py
Commit message: SQL Insert error for some region [FIXED]


Vulnerable code:
        self.cursor.execute(sentence)
        self.cursor.execute(sentence)
        self.cursor.execute(sentence)
            'get_data' : "SELECT victims.*, geo.*, victims.ip AS ip_local, COUNT(clicks.id) FROM victims INNER JOIN geo ON victims.id = geo.id LEFT JOIN clicks ON clicks.id = victims.id GROUP BY victims.id ORDER BY victims.time DESC",
            'all_networks' : "SELECT networks.* FROM networks ORDER BY id",
            'get_preview' : "SELECT victims.*, geo.*, victims.ip AS ip_local FROM victims INNER JOIN geo ON victims.id = geo.id WHERE victims.id = '%s'" % (vId),
            'id_networks' : "SELECT networks.* FROM networks WHERE id = '%s'" % (vId),
            'get_requests' : "SELECT requests.*, geo.ip FROM requests INNER JOIN geo on geo.id = requests.user_id ORDER BY requests.date DESC, requests.id ",
            'get_sessions' : "SELECT COUNT(*) AS Total FROM networks",
            'get_clicks' : "SELECT COUNT(*) AS Total FROM clicks",
            'get_online' : "SELECT COUNT(*) AS Total FROM victims WHERE status = '%s'" % ('online')
        return self.sql_execute(self.prop_sentences_stats(type, vId))
            return "SELECT COUNT(*) AS C FROM victims WHERE id = '%s'" % (data)
            return "SELECT COUNT(*) AS C FROM clicks WHERE id = '%s'" % (data)
            return "UPDATE victims SET ip = '%s', date = '%s', bVersion = '%s', browser = '%s', device = '%s', ports = '%s', time = '%s', cpu = '%s', status = '%s' WHERE id = '%s'" % (data[0].ip, data[0].date, data[0].version, data[0].browser, data[0].device, data[0].ports, data[2], data[0].cpu, 'online', data[1])
            return "UPDATE geo SET city = '%s', country_code = '%s', country_name = '%s', ip = '%s', latitude = '%s', longitude = '%s', metro_code = '%s', region_code = '%s', region_name = '%s', time_zone = '%s', zip_code = '%s', isp = '%s', ua='%s' WHERE id = '%s'" % (data[0].city, data[0].country_code, data[0].country_name, data[0].ip, data[0].latitude, data[0].longitude, data[0].metro_code, data[0].region_code, data[0].region_name, data[0].time_zone, data[0].zip_code, data[0].isp, data[0].ua, data[1])
            return "INSERT INTO victims(id, ip, date, bVersion, browser, device, ports, time, cpu, status) VALUES('%s','%s', '%s','%s', '%s','%s', '%s', '%s', '%s', '%s')" % (data[1], data[0].ip, data[0].date, data[0].version, data[0].browser, data[0].device, data[0].ports, data[2], data[0].cpu, 'online')
            return "INSERT INTO geo(id, city, country_code, country_name, ip, latitude, longitude, metro_code, region_code, region_name, time_zone, zip_code, isp, ua) VALUES('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s')"  % (data[1], data[0].city, data[0].country_code, data[0].country_name, data[0].ip, data[0].latitude, data[0].longitude, data[0].metro_code, data[0].region_code, data[0].region_name, data[0].time_zone, data[0].zip_code, data[0].isp, data[0].ua)
            return "SELECT COUNT(*) AS C FROM networks WHERE id = '%s' AND network = '%s'" % (data[0], data[1])
            return "DELETE FROM networks WHERE id = '%s'" % (data[0])
            return "UPDATE networks SET date = '%s' WHERE id = '%s' AND network = '%s'" % (data[2], data[0], data[1])
            return "INSERT INTO networks(id, public_ip, ip, network, date) VALUES('%s','%s', '%s', '%s','%s')" % (data[0], data[1], data[2], data[3], data[4])
            return "INSERT INTO requests(id, user_id, site, fid, name, value, date) VALUES('%s', '%s','%s', '%s', '%s','%s', '%s')" % (data[0].sId, data[0].id, data[0].site, data[0].fid, data[0].name, data[0].value, data[1])
            return "INSERT INTO clicks(id, site, date) VALUES('%s', '%s','%s')" % (data[0], data[1], data[2])
            return "UPDATE victims SET status = '%s' WHERE id = '%s'" % ('online', data[0])
            return "UPDATE victims SET status = '%s' " % ('offline')
            return "UPDATE victims SET status = '%s' WHERE id = '%s'" % ('offline', data)
            return False
            return self.sql_insert(self.prop_sentences_victim(type, data))
            return self.sql_one_row(self.prop_sentences_victim(type, data), column)
            return self.sql_execute(self.prop_sentences_victim(type, data))
    ('clean_online')
    rows = db.sentences_stats('get_online')
    d = db.sentences_stats('get_preview', vId)
    n = db.sentences_stats('id_networks', vId)
        db.sentences_victim('report_online', [vrequest])

Fixed code:
    	if type(sentence) is str:
        	self.cursor.execute(sentence)
    	else:
        	self.cursor.execute(sentence[0], sentence[1])
        if type(sentence) is str:
        	self.cursor.execute(sentence)
    	else:
        	self.cursor.execute(sentence[0], sentence[1])	
        if type(sentence) is str:
        	self.cursor.execute(sentence)
    	else:
        	self.cursor.execute(sentence[0], sentence[1])
        	'get_data' : "SELECT victims.*, geo.*, victims.ip AS ip_local, COUNT(clicks.id) FROM victims INNER JOIN geo ON victims.id = geo.id LEFT JOIN clicks ON clicks.id = victims.id GROUP BY victims.id ORDER BY victims.time DESC",
        	'all_networks' : "SELECT networks.* FROM networks ORDER BY id",
        	'get_preview' : ("SELECT victims.*, geo.*, victims.ip AS ip_local FROM victims INNER JOIN geo ON victims.id = geo.id WHERE victims.id = ?" , vId),
        	'id_networks' : ("SELECT networks.* FROM networks WHERE id = ?", vId),
        	'get_requests' : "SELECT requests.*, geo.ip FROM requests INNER JOIN geo on geo.id = requests.user_id ORDER BY requests.date DESC, requests.id ",
        	'get_sessions' : "SELECT COUNT(*) AS Total FROM networks",
        	'get_clicks' : "SELECT COUNT(*) AS Total FROM clicks",
        	'get_online' : ("SELECT COUNT(*) AS Total FROM victims WHERE status = ?", vId)
    	return self.sql_execute(self.prop_sentences_stats(type, vId))
        	t = (data,)
        	return ("SELECT COUNT(*) AS C FROM victims WHERE id = ?" , t)
        	t = (data,)
        	return ("SELECT COUNT(*) AS C FROM clicks WHERE id = ?" , t)
        	t = (data[0].ip, data[0].date, data[0].version, data[0].browser, data[0].device, data[0].ports, data[2], data[0].cpu, 'online', data[1],)
        	return ("UPDATE victims SET ip = ?, date = ?, bVersion = ?, browser = ?, device = ?, ports = ?, time = ?, cpu = ?, status = ? WHERE id = ?", t)
        	t = (data[0].city, data[0].country_code, data[0].country_name, data[0].ip, data[0].latitude, data[0].longitude, data[0].metro_code, data[0].region_code, data[0].region_name, data[0].time_zone, data[0].zip_code, data[0].isp, data[0].ua, data[1],)
        	return ("UPDATE geo SET city = ?, country_code = ?, country_name = ?, ip = ?, latitude = ?, longitude = ?, metro_code = ?, region_code = ?, region_name = ?, time_zone = ?, zip_code = ?, isp = ?, ua=? WHERE id = ?", t)
        	t = (data[1], data[0].ip, data[0].date, data[0].version, data[0].browser, data[0].device, data[0].ports, data[2], data[0].cpu, 'online',)
        	return ("INSERT INTO victims(id, ip, date, bVersion, browser, device, ports, time, cpu, status) VALUES(?,?, ?,?, ?,?, ?, ?, ?, ?)", t)
        	t = (data[1], data[0].city, data[0].country_code, data[0].country_name, data[0].ip, data[0].latitude, data[0].longitude, data[0].metro_code, data[0].region_code, data[0].region_name, data[0].time_zone, data[0].zip_code, data[0].isp, data[0].ua,)
        	return ("INSERT INTO geo(id, city, country_code, country_name, ip, latitude, longitude, metro_code, region_code, region_name, time_zone, zip_code, isp, ua) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)" , t)
        	return ("SELECT COUNT(*) AS C FROM networks WHERE id = ? AND network = ?", (data[0], data[1],))
        	return ("DELETE FROM networks WHERE id = ?", (data[0],))
        	return ("UPDATE networks SET date = ? WHERE id = ? AND network = ?" , (data[2], data[0], data[1],))
        	t = (data[0], data[1], data[2], data[3], data[4],)
        	return ("INSERT INTO networks(id, public_ip, ip, network, date) VALUES(?,?, ?, ?,?)" , t)
        	t = (data[0].sId, data[0].id, data[0].site, data[0].fid, data[0].name, data[0].value, data[1],)
        	return ("INSERT INTO requests(id, user_id, site, fid, name, value, date) VALUES(?, ?,?, ?, ?,?, ?)" , t)
        	return ("INSERT INTO clicks(id, site, date) VALUES(?, ?,?)", (data[0], data[1], data[2],))
        	return ("UPDATE victims SET status = ? WHERE id = ?" , ('online', data[0],))
        	return ("UPDATE victims SET status = ? ", ('offline',))
        	return ("UPDATE victims SET status = ? WHERE id = ?" , ('offline', data,))
        	return False
        	return self.sql_insert(self.prop_sentences_victim(type, data))
        	return self.sql_one_row(self.prop_sentences_victim(type, data), column)
        	return self.sql_execute(self.prop_sentences_victim(type, data))
    vId = ('online', )
    rows = db.sentences_stats('get_online', vId)
    t = (vId,)
    d = db.sentences_stats('get_preview', t)
    n = db.sentences_stats('id_networks', t)
        db.sentences_victim('report_online', [vrequest], 2)