CVE-2015-2972 (Ruby, published 2015-07-19T15:59Z)
Description: value: Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/sysphonic/thetis
Files changed:
app/controllers/desktop_controller.rb
app/controllers/equipment_controller.rb
app/controllers/folders_controller.rb
app/controllers/items_controller.rb
app/controllers/locations_controller.rb
app/controllers/login_controller.rb
app/controllers/researches_controller.rb
app/controllers/schedules_controller.rb
app/controllers/send_mails_controller.rb
app/controllers/timecards_controller.rb
app/controllers/users_controller.rb
app/controllers/zeptair_dist_controller.rb
app/helpers/sql_helper.rb
db/migrate/20110524100000_changes_for_ver110.rb
Commit message: Reinforcement of security.
Signed-off-by: MORITA Shintaro <shin@sysphonic.com>


Vulnerable code:
    elsif !params[:group_id].nil? and !params[:group_id].empty?
      elsif !params[:group_id].nil? and !params[:group_id].empty?
    elsif !params[:group_id].nil? and !params[:group_id].empty?
    @users = Group.get_users @group_id
    elsif !params[:group_id].nil? and !params[:group_id].empty?
    @users = Group.get_users @group_id
    begin
    unless team_id.nil? or team_id.empty?
      unless team_id.nil? or team_id.empty?
        if team_id.nil? or team_id.empty?
    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
      users = User.where("email='#{params[:thetisBoxEdit]}'").to_a
    unless params[:page].nil? or params[:page].empty?
    if params[:research_id].nil? or params[:research_id].empty?
      @research = Research.find(params[:research_id])
    elsif !params[:group_id].nil? and !params[:group_id].empty?
    elsif !params[:group_id].nil? and !params[:group_id].empty?
    elsif !params[:group_id].nil? and !params[:group_id].empty?
    return if params[:id].nil? or params[:id].empty? or @login_user.nil?
    extra_chars ||= []
    regexp = Regexp.new("^\s*[a-zA-Z0-9_.#{extra_chars.join()}]+\s*$")
    teams = Team.all
    unless teams.nil?
      teams.each do |team|
        begin
          item = Item.find(team.item_id)
        rescue
        end
        next if item.nil?

        attrs = ActionController::Parameters.new({created_at: item.created_at, updated_at: item.updated_at})
        attrs.permit!
        team.update_attributes(attrs)

Fixed code:
    elsif !params[:group_id].blank?
    SqlHelper.validate_token([@group_id])
    SqlHelper.validate_token([@group_id])

      elsif !params[:group_id].blank?
      SqlHelper.validate_token([@group_id])
    SqlHelper.validate_token([params[:id]])
    elsif !params[:group_id].blank?
    SqlHelper.validate_token([@group_id])
    @users = Group.get_users(@group_id)
    elsif !params[:group_id].blank?
    SqlHelper.validate_token([@group_id])
    @users = Group.get_users(@group_id)
   begin
    unless team_id.blank?
      unless team_id.blank?
        if team_id.blank?
    SqlHelper.validate_token([params[:status]])

    return if params[:id].blank? or @login_user.nil?
    SqlHelper.validate_token([@group_id])
    SqlHelper.validate_token([group_id])
    SqlHelper.validate_token([group_id])
    mail_addr = params[:thetisBoxEdit]
    SqlHelper.validate_token([mail_addr], ['@-'])
      users = User.where("email='#{mail_addr}'").to_a
    unless params[:page].blank?
      SqlHelper.validate_token([@page])
    research_id = params[:research_id]
    SqlHelper.validate_token([research_id])
    if research_id.blank?
      @research = Research.find(research_id)
    SqlHelper.validate_token([@group_id])

      SqlHelper.validate_token([@group_id])
    elsif !params[:group_id].blank?
    SqlHelper.validate_token([@group_id])
    elsif !params[:group_id].blank?
    SqlHelper.validate_token([@group_id])
    elsif !params[:group_id].blank?
    SqlHelper.validate_token([@group_id])
    return if params[:id].blank? or @login_user.nil?
    SqlHelper.validate_token([@group_id])

    SqlHelper.validate_token([@group_id])
    SqlHelper.validate_token([@group_id])
    return unless request.post?

    SqlHelper.validate_token([@group_id])

    extra_chars = Regexp.escape((extra_chars || []).join())
    regexp = Regexp.new("^[ ]*[a-zA-Z0-9_.#{extra_chars}]+[ ]*$")
    Team.find_each do |team|
      begin
        item = Item.find(team.item_id)
      rescue
      next if item.nil?

      attrs = ActionController::Parameters.new({created_at: item.created_at, updated_at: item.updated_at})
      attrs.permit!
      team.update_attributes(attrs)