CVE-2014-125065 (Python, published 2023-01-07T20:15Z)
Description: value: A vulnerability, which was classified as critical, was found in john5223 bottle-auth. Affected is an unknown function. The manipulation leads to sql injection. The name of the patch is 99cfbcc0c1429096e3479744223ffb4fda276875. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217632.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/john5223/bottle-auth
Files changed:
auth/controllers/group_controller.py
auth/controllers/user_controller.py
tests/test_integration.py
tests/test_units.py
Commit message: no more sql injection and better tests


Vulnerable code:
    userids = ["'%s'" % x['userid'] for x in rows if x['userid']]
    users = db.query("SELECT * FROM users WHERE userid IN (%s) " % ','.join(userids))
    ret = {group_name: list(users) }
def create__update_user(db, userid):
        q = '''DELETE FROM groups 
                WHERE userid='{userid}'
                            AND name not in ({group_names})
              '''.format(userid=userid, group_names=','.join(["'%s'" % x for x in groups]))
        db.query(q)
def test_users():
def test_groups():

Fixed code:
    userids = [x['userid'] for x in rows if x['userid']]
    if not userids:
        return {group_name: []}

    params = {}
    for i, userid in enumerate(userids,1):
        params['userid_' + str(i)] = str(userid)
    where_clause = 'userid IN(:' + ",:".join(params.keys()) + ')' # b/c sqlalchemy can't use a list!?
    q = "SELECT * FROM users WHERE " + where_clause
    users = db.executable.execute(q, params).fetchall()
    ret = {group_name: [dict(x.items()) for x in users] }
def create_update_user(db, userid):
        params = {}
        for counter, group in enumerate(groups,1):
            params["group_name" + str(counter)] = group
            counter += 1
        where_clause = 'name NOT IN(:' + ",:".join(params.keys()) + ')' # b/c sqlalchemy can't use a list!?
        params['userid'] = userid
        q = '''DELETE FROM groups WHERE userid=:userid AND ''' + where_clause
        db.executable.execute(q, params)
def test_user_integration():
def test_groups_integration():
import logging
logging.basicConfig(level=logging.DEBUG)
import json

from webtest import TestApp #Docs: http://webtest.pythonpaste.org/en/latest/
from auth import simpleauth


app = TestApp(simpleauth.app)

def test_sql_injection():
	
	pass


def test_create_user():
	pass

def test_update_user():
	pass

def test_delete_user():
	pass



def test_create_group():
	pass

def test_update_group():
	pass

def test_delete_group():
	pass