CVE-2022-4454 (Java, published 2022-12-13T18:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in m0ver bible-online. Affected by this issue is the function query of the file src/main/java/custom/application/search.java of the component Search Handler. The manipulation leads to sql injection. The name of the patch is 6ef0aabfb2d4ccd53fcaa9707781303af357410e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215444.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/m0ver/bible-online
Files changed:
src/main/java/custom/application/search.java
Commit message: Fixed the SQL Injection issue.


Vulnerable code:
        StringBuffer condition = new StringBuffer();
        String _keyword;
            _keyword = keywords[i];
            if (_keyword.trim().length() > 0) {
                if (condition.length() == 0) {
                    condition.append(" bible.content like '%" + _keyword + "%' ");
                } else {
                    condition.append(" AND bible.content like '%" + _keyword + "%' ");
                    /*
                     * if(true)
                     * condition.append(" AND bible.content like '%"+keywords[i]+"%' ");
                     * else
                     * condition.append(" OR bible.content like '%"+keywords[i]+"%' ");
                     */
                }
            condition.append(" book.language='" + locale + "' ");
            condition.append(" AND book.language='" + locale + "' ");
        Table vtable = bible.find(SQL, new Object[]{});
        Row found = bible.findOne(look, new Object[]{});
        html.append("<ol class=\"searchresults\" start=\"" + next + "\">\r\n");
                + String.valueOf(System.currentTimeMillis() - startTime) + " -->");
        StringBuffer xml = new StringBuffer();

Fixed code:
        StringBuilder condition = new StringBuilder();
        String[] _keywords = new String[keywords.length];
            _keywords[i] = "%" + keywords[i] + "%";
            if (condition.length() == 0) {
                condition.append(" bible.content like ? ");
            } else {
                condition.append(" AND bible.content like ? ");
            condition.append(" book.language='").append(locale).append("' ");
            condition.append(" AND book.language='").append(locale).append("' ");
        Table vtable = bible.find(SQL, _keywords);
        Row found = bible.findOne(look, _keywords);
        html.append("<ol class=\"searchresults\" start=\"").append(next).append("\">\r\n");
                + (System.currentTimeMillis() - startTime) + " -->");
        StringBuilder xml = new StringBuilder();