CVE-2015-10020 (Java, published 2023-01-14T21:15Z)
Description: value: A vulnerability has been found in ssn2013 cis450Project and classified as critical. This vulnerability affects the function addUser of the file HeatMapServer/src/com/datformers/servlet/AddAppUser.java. The manipulation leads to sql injection. The name of the patch is 39b495011437a105c7670e17e071f99195b4922e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218380.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/ssn2013/cis450Project
Files changed:
HeatMapServer/src/com/datformers/database/OracleDBWrapper.java
HeatMapServer/src/com/datformers/servlet/AddAppUser.java
HeatMapServer/src/com/datformers/servlet/HeatMapServlet.java
HeatMapServer/src/com/datformers/servlet/LoginServlet.java
Commit message: sql injection changes


Vulnerable code:
	public AddAppUser(String str){
		ResultSet rs = wrapper.executeQuery(query);
			System.out.println("QString: "+queryString);
				System.out.println("user:pwd" + username + password);
				String query = "Select password from APPUSER where email LIKE '"
						+ username + "'";
				System.out.println(query);
				tmp = new AddAppUser(query);
					System.out.println(isValidPwd);
					String query = "SELECT count(*) as cnt FROM APPUSER WHERE email LIKE '"
							+ email + "'";
					AddAppUser add = new AddAppUser(query);
					System.out.println("Signup query" + query);
								+ " values (usr_id.NEXTVAL,'"
								+ email
								+ "','"
						AddAppUser tmp = new AddAppUser(query1);

Fixed code:
import java.util.ArrayList;
	public ResultSet executeValidateQuery(String query,ArrayList<String> params) {
		PreparedStatement  preparedStatement;

		 ResultSet rs = null;
		 
		try {
			preparedStatement=conn.prepareStatement(query) ;
			for(int i=0;i<params.size();i++) {
				preparedStatement.setString(i+1,params.get(i));	
			}
			
			rs = preparedStatement.executeQuery();
			
		} catch (Exception e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}
		
			return rs;
	}
import java.util.ArrayList;
	ArrayList<String> params=null;
	public AddAppUser(String str,ArrayList<String> p){
		params=p;
		ResultSet rs = wrapper.executeValidateQuery(query, params);
			
import java.util.ArrayList;
				
				String query = "Select password from APPUSER where email=?";
//						+ username + "'";
				
				ArrayList<String> params=new ArrayList<String>();
				params.add(username);
				tmp = new AddAppUser(query,params);
					
					String query = "SELECT count(*) as cnt FROM APPUSER WHERE email=?";
//							+ email + "'";
					ArrayList<String> params=new ArrayList<String>();
					params.add(email);
					AddAppUser add = new AddAppUser(query,params);
					
						params=new ArrayList<String>();
						params.add(email);
								+ " values (usr_id.NEXTVAL,?"
//								+ email
								+ ",'"
						AddAppUser tmp = new AddAppUser(query1,params);