CVE-2015-10048 (Java, published 2023-01-15T10:15Z)
Description: value: A vulnerability was found in bmattoso desafio_buzz_woody. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is cb8220cbae06082c969b1776fcb2fdafb3a1006b. It is recommended to apply a patch to fix this issue. The identifier VDB-218357 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/bmattoso/desafio_buzz_woody
Files changed:
injectIt/src/main/java/com/dextra/injectit/database/Database.java
injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
injectIt/target/injectIt-1.0-SNAPSHOT/index.html
injectIt/target/injectIt-1.0-SNAPSHOT/js/index.js
injectIt/target/injectIt-1.0-SNAPSHOT/templates/template.html
injectIt/target/maven-archiver/pom.properties
injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst
injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/inputFiles.lst
injectIt/target/tomcat/logs/access_log.2015-02-08
Commit message: Método de execute alterado para SQLINJECTION , faltando apenas o método de StoredProcedure


Vulnerable code:
		Statement s = null;
			s = conn.createStatement();
			if (s.execute(sql)) {
				return s.getResultSet();
			} else {
			}
				if (s != null) {
					s.close();
		String query = "SELECT * FROM USER WHERE NAME = '" + name + "'";
		ResultSet users = Database.execute(query);
		String query = "SELECT * FROM USER WHERE NAME = ?";
		ResultSet users = Database.execute(query);
		ArrayList<User> searchedUsers = new ArrayList<User>();
		try {
		} catch (SQLException e) {
<script src="http://code.jquery.com/jquery-2.1.3.js"
	type="text/javascript"></script>
    $.ajax({
        url : 'api/usuarios',
        type : "GET",
    }).done(function(resp) {
        $("#usuarios").html(resp);
    });
    $("#pesquisar").click(function() {
        $.ajax({
            url : 'api/usuarios',
            type : "GET",
            data : {
                name : $("#search").val()
            }
        }).done(function(resp) {
            $("#usuarios").html(resp);
        });
    });
<tbody>
{{~it : client}}
	<td>{{=client.name}}</td>
	<td>{{=client.password}}</td>
	<td>{{=client.creditCardNumber}}</td>
#Fri Feb 06 13:33:32 BRST 2015
<<<<<<< HEAD
=======
com/dextra/injectit/database/MockDatabase.class
>>>>>>> a83373cb29646b4fd9576b44d0ae4a4128cd7637
com/dextra/injectit/booter/ContextListener.class
com/dextra/injectit/servlets/InjectServlet.class
com/dextra/injectit/database/User.class
<<<<<<< HEAD
/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
=======
/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
>>>>>>> a83373cb29646b4fd9576b44d0ae4a4128cd7637

Fixed code:
import java.sql.CallableStatement;
import java.sql.PreparedStatement;
import sun.security.provider.ConfigFile.Spi;

	public static ResultSet executeStoredPrcedure(String spCalled, Object... parameters){
		Connection conn = getConnection();
		CallableStatement cs = null;

		try {
			cs = conn.prepareCall(spCalled);
			if (parameters != null)
				for (int parameterIndex = 0; parameterIndex < parameters.length; ++parameterIndex){
					cs.setObject(parameterIndex + 1, parameters[parameterIndex]);
				}
			System.out.println(cs.toString());
			if (cs.execute())
				return  cs.executeQuery();	
			else 
				return null;
		} catch (SQLException e) {
		
			throw new RuntimeException(e);
		
		} finally {
			try {
				if (cs != null) {
					cs.close();
				}
				conn.close();
			} catch (SQLException e) {
				throw new RuntimeException(e);
			}
		}
	}
	
		PreparedStatement ps = null;
			System.out.println(sql);
			ps = conn.prepareStatement(sql);
			
			// Set the parameters
			if (objects != null)
				for (int parameterIndex = 0; parameterIndex < objects.length; ++parameterIndex){
					ps.setObject(parameterIndex + 1, objects[parameterIndex]);
				}
			
			if (ps.execute())
				return ps.getResultSet();
			else
			
			e.printStackTrace();
				if (ps != null) {
					ps.close();
		
		String sp = "CREATE PROCEDURE sp_getUser "
				+ "(@user VARCHAR(100)) "
				+ "AS "
				+ "BEGIN "
				+ "SELECT * FROM USER WHERE NAME = @user "
				+ "END";
		Database.execute(sp);
import com.dextra.injectit.database.MockDatabase;
		String[] names = new String[1];
		names[0] = name;
		String query = "SELECT * FROM USER WHERE NAME = ?";
		ResultSet users = Database.execute(query,names);
		try {
			MockDatabase.execute();
			
			
			String query = "{call sp_getUser(?)}";
			Object []objs = new Object [1];
			objs[0] = "Jefferson";
			
			ResultSet users = Database.executeStoredPrcedure(query, objs);
			ArrayList<User> searchedUsers = new ArrayList<User>();
		} catch (Exception e) {
	
	<script src="http://code.jquery.com/jquery-2.1.3.js" type="text/javascript"></script>
	<script src="js/index.js" type="text/javascript"></script>
	<script src="js/doT.js" type="text/javascript"></script>
	
$(document).ready(function(){
	$.ajax({
		type : 'GET',
		url : 'api/usuarios',
		dataType : 'json'
	}).success(function(strJson) {
		$.get('templates/template.html').done(function(template) {
			$('#usuarios').html(doT.template(template)(strJson));
		});
	})
});
$('#pesquisar').click(function() {

	$.ajax({
		url : 'api/usuarios',
		type : 'POST',
		data : {
			name : $('#search').val()
		},
		dataType : 'json'
	}).done(function(resp) {
		console.info(resp);
		$.get('templates/template.html',function (template){
			$("#usuarios").html(doT.template(template)(resp));
		}, "html");

	});
});
<tbody> 
{{console.info(it);}}
{{~it :user}}
	{{console.info();}}
	<td>{{=user.name}}</td>
	<td>{{=user.password}}</td>
	<td>{{=user.creditCardNumber}}</td>
#Sun Feb 08 22:05:57 BRST 2015
com/dextra/injectit/database/User.class
/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
127.0.0.1 - - [08/Feb/2015:22:34:56 -0200] "GET / HTTP/1.1" 404 - http-bio-8080-exec-1 0
127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt HTTP/1.1" 302 - http-bio-8080-exec-2 0
127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/ HTTP/1.1" 200 582 http-bio-8080-exec-3 215
127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/js/index.js HTTP/1.1" 200 597 http-bio-8080-exec-4 7
127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/js/doT.js HTTP/1.1" 200 5163 http-bio-8080-exec-5 31
127.0.0.1 - - [08/Feb/2015:22:35:06 -0200] "GET /injectIt/api/usuarios HTTP/1.1" 405 1065 http-bio-8080-exec-7 4
127.0.0.1 - - [08/Feb/2015:22:35:10 -0200] "POST /injectIt/api/usuarios HTTP/1.1" 200 12 http-bio-8080-exec-8 58
127.0.0.1 - - [08/Feb/2015:22:35:10 -0200] "GET /injectIt/templates/template.html HTTP/1.1" 200 296 http-bio-8080-exec-9 27
127.0.0.1 - - [08/Feb/2015:22:35:14 -0200] "POST /injectIt/api/usuarios HTTP/1.1" 200 84 http-bio-8080-exec-10 10
127.0.0.1 - - [08/Feb/2015:22:54:04 -0200] "GET /help/topic/com.vmware.ICbase/images/vmware_favicon.ico HTTP/1.1" 404 - http-bio-8080-exec-2 0