CVE-2015-10047 (Java, published 2023-01-15T10:15Z)
Description: value: A vulnerability was found in KYUUBl school-register. It has been classified as critical. This affects an unknown part of the file src/DBManager.java. The manipulation leads to sql injection. The patch is named 1cf7e01b878aee923f2b22cc2535c71a680e4c30. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218355.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/KYUUBl/school-register
Files changed:
src/DBManager.java
Commit message: fuck sql injection


Vulnerable code:
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.Statement;
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addStudentGrade(int subjectID, String studentID, int gradeValue, int activityID, String topic) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(" + subjectID + "," + studentID + "," + gradeValue + "," + activityID + ",'" + topic + "');");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addStudentNote(String studentID, int teacherID, String note, boolean isPositive, String date) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values('" + studentID + "'," + teacherID + ",'" + note + "'," + isPositive + ",to_date('" + date + "', 'DD.MM.YYYY'));");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addStudentAbsence(String studentID, int lessonID) {
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        stmt.executeUpdate("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date('" + data + "', 'DD.MM.YYYY')," + teacherID + "," + lessonID + ",'" + topic + "');");
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addStudent(String name, String lastname, String pesel, int phoneNumber, int classID) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values('" + name + "','" + lastname + "','" + pesel + "'," + phoneNumber + "," + classID + ");");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addclass(String section, int startYear, int tutorID) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values('" + section + "'," + startYear + "," + tutorID + ");");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addTeacher(String name, String lastname) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO nauczyciele(imie,nazwisko) values('" + name + "','" + lastname + "');");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addSubject(String name, int classID, int teacherID) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values('" + name + "'," + classID + "," + teacherID + ");");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addScheduleLesson(int subjectID, int lessonNumber, int weekday) {
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void yearEnd() {
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void deactivateStudent(String studentID) {
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addStudentUser(String login, String password, String pesel) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
                        stmt.executeUpdate("UPDATE uczniowie SET id_uzytkownika = '" + login + "' where pesel='" + pesel + "';");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void addTeacherUser(String login, String password, int teacherID) {
                        stmt = c.createStatement();
                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
                        stmt.executeUpdate("UPDATE nauczyciele SET id_uzytkownika = '" + login + "' where id=" + teacherID + ";");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        stmt = c.createStatement();
                        ResultSet rs = stmt.executeQuery("SELECT * from uzytkownicy join uczniowie on login=id_uzytkownika where login='" + login + "';");
                        rs = stmt.executeQuery("SELECT * from uzytkownicy join nauczyciele on login=id_uzytkownika where login='" + login + "';");
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void changeStudentPassword(String pesel,String password){
                        stmt = c.createStatement();
                        ResultSet rs = stmt.executeQuery("select id_uzytkownika from uzytkownicy uz join uczniowie on id_uzytkownika=uz.login where pesel='" + pesel + "';");
                        stmt.close();
                        stmt = c.createStatement();
                        stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login='"+userID+"';");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public void changeTeacherPassword(int id,String password){
                        stmt = c.createStatement();
                        ResultSet rs = stmt.executeQuery("select id_uzytkownika from uzytkownicy uz join nauczyciele on id_uzytkownika=uz.login where id=" + id + ";");
                        stmt.close();
                        stmt = c.createStatement();
                        stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login = '"+userID+"';");
                        stmt.close();
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        e.printStackTrace();
                        System.err.println(e.getClass().getName() + ": " + e.getMessage());



                ArrayList<Pair<Integer,String> > sub = dbManager.getStudentSubjects("95091673574");
                for(int i=0;i<sub.size();i++) System.out.println(sub.get(i).getX()+" "+sub.get(i).getY());

Fixed code:
import java.sql.*;
import java.util.regex.Pattern;
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addStudentGrade(int subjectID, String studentID, int gradeValue, int activityID, String topic) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(?,?,?,?,?);");
                        ps.setInt(1,subjectID);
                        ps.setString(2, studentID);
                        ps.setInt(3,gradeValue);
                        ps.setInt(4,activityID);
                        ps.setString(5,topic);
                        ps.executeUpdate();
                        ps.close();
                        //stmt = c.createStatement();
                        //stmt.executeUpdate("INSERT INTO oceny_uczniow(id_przedmiotu,id_ucznia,wartosc,id_aktywnosci,tematyka) values(" + subjectID + "," + studentID + "," + gradeValue + "," + activityID + ",'" + topic + "');");
                        //stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addStudentNote(String studentID, int teacherID, String note, boolean isPositive, String date) {
                        PreparedStatement ps =c.prepareStatement("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values(?,?,?,?,to_date(?, 'DD.MM.YYYY'));");
                        ps.setString(1,studentID);
                        ps.setInt(2, teacherID);
                        ps.setString(3, note);
                        ps.setBoolean(4, isPositive);
                        ps.setString(5, date);
                        ps.executeUpdate();
                        ps.close();
                        //stmt = c.createStatement();
                        //stmt.executeUpdate("INSERT INTO uwagi(id_ucznia,id_nauczyciela,opis,czy_pozytywna,data_wystawienia) values('" + studentID + "'," + teacherID + ",'" + note + "'," + isPositive + ",to_date('" + date + "', 'DD.MM.YYYY'));");
                        //stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addStudentAbsence(String studentID, int lessonID) {
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        PreparedStatement ps = c.prepareStatement("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date(?, 'DD.MM.YYYY'),?,?,?);");
                        ps.setString(1,data);
                        ps.setInt(2,teacherID);
                        ps.setInt(3,lessonID);
                        ps.setString(4,topic);
                        ps.executeUpdate();
                        ps.close();
                        //stmt.executeUpdate("INSERT INTO przeprowadzone_lekcje(data,id_prowadzacego,id_lekcji,temat_zajec) values(to_date('" + data + "', 'DD.MM.YYYY')," + teacherID + "," + lessonID + ",'" + topic + "');");
                        return -1;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addStudent(String name, String lastname, String pesel, int phoneNumber, int classID) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values(?,?,?,?,?);");
                        ps.setString(1,name);
                        ps.setString(2,lastname);
                        ps.setString(3,pesel);
                        ps.setInt(4,phoneNumber);
                        ps.setInt(5,classID);
                        ps.executeUpdate();
                        ps.close();
                        //stmt = c.createStatement();
                        //stmt.executeUpdate("INSERT INTO uczniowie(imie,nazwisko,pesel,telefon_do_rodzica,id_klasy) values('" + name + "','" + lastname + "','" + pesel + "'," + phoneNumber + "," + classID + ");");
                        //stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addclass(String section, int startYear, int tutorID) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values(?,?,?);");
                        ps.setString(1,section);
                        ps.setInt(2,startYear);
                        ps.setInt(3,tutorID);
                        ps.executeUpdate();
                        ps.close();
//                        stmt = c.createStatement();
//                        stmt.executeUpdate("INSERT INTO klasy(oddzial,rok_rozpoczecia,id_wychowawcy) values('" + section + "'," + startYear + "," + tutorID + ");");
//                        stmt.close();
                        return true;
                        return false;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addTeacher(String name, String lastname) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO nauczyciele(imie,nazwisko) values(?,?);");
                        ps.setString(1,name);
                        ps.setString(2,lastname);
                        ps.executeUpdate();
                        ps.close();
//                        stmt = c.createStatement();
//                        stmt.executeUpdate("INSERT INTO nauczyciele(imie,nazwisko) values('" + name + "','" + lastname + "');");
//                        stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addSubject(String name, int classID, int teacherID) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values(?,?,?);");
                        ps.setString(1,name);
                        ps.setInt(2,classID);
                        ps.setInt(3,teacherID);
                        ps.executeUpdate();
                        ps.close();
//                        stmt = c.createStatement();
//                        stmt.executeUpdate("INSERT INTO przedmioty(nazwa,id_klasy,id_prowadzacego) values('" + name + "'," + classID + "," + teacherID + ");");
//                        stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addScheduleLesson(int subjectID, int lessonNumber, int weekday) {
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean yearEnd() {
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean deactivateStudent(String studentID) {
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addStudentUser(String login, String password, String pesel) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO uzytkownicy(login,haslo) values(?,?);");
                        ps.setString(1,login);
                        ps.setString(2,password);
                        ps.executeUpdate();
                        ps.close();
                        ps = c.prepareStatement("UPDATE uczniowie SET id_uzytkownika = ? where pesel=?;");
                        ps.setString(1,login);
                        ps.setString(2,pesel);
                        ps.executeUpdate();
                        ps.close();
//                        stmt = c.createStatement();
//                        stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
//                        stmt.executeUpdate("UPDATE uczniowie SET id_uzytkownika = '" + login + "' where pesel='" + pesel + "';");
//                        stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean addTeacherUser(String login, String password, int teacherID) {
                        PreparedStatement ps = c.prepareStatement("INSERT INTO uzytkownicy(login,haslo) values(?,?);");
                        ps.setString(1,login);
                        ps.setString(2,password);
                        ps.executeUpdate();
                        ps.close();
                        ps = c.prepareStatement("UPDATE nauczyciele SET id_uzytkownika = ? where id=?;");
                        ps.setString(1,login);
                        ps.setInt(2, teacherID);
                        ps.executeUpdate();
                        ps.close();
                        //stmt = c.createStatement();
                        //stmt.executeUpdate("INSERT INTO uzytkownicy(login,haslo) values('" + login + "','" + password + "');");
                        //stmt.executeUpdate("UPDATE nauczyciele SET id_uzytkownika = '" + login + "' where id=" + teacherID + ";");
                        //stmt.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        PreparedStatement ps = c.prepareStatement("SELECT * from uzytkownicy join uczniowie on login=id_uzytkownika where login=?;");
                        ps.setString(1,login);
                        //stmt = c.createStatement();
                        ResultSet rs = ps.executeQuery();
                        ps= c.prepareStatement("SELECT * from uzytkownicy join nauczyciele on login=id_uzytkownika where login=?';");
                        ps.setString(1,login);
                        rs = ps.executeQuery();
                        ps.close();
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean changeStudentPassword(String pesel,String password){
                        PreparedStatement ps = c.prepareStatement("select id_uzytkownika from uzytkownicy uz join uczniowie on id_uzytkownika=uz.login where pesel=?;");
                        ps.setString(1,pesel);
                        //stmt = c.createStatement();
                        ResultSet rs = ps.executeQuery();
                        //stmt.close();
                        //stmt = c.createStatement();
                        ps= c.prepareStatement("UPDATE uzytkownicy SET haslo = ? where login=?;");
                        ps.setString(1,password);
                        ps.setString(2,userID);
                        ps.executeUpdate();
                        //stmt.executeUpdate("UPDATE uzytkownicy SET haslo = '"+password+"' where login='"+userID+"';");
                        ps.close();
                        return true;
                        return false;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
        public boolean changeTeacherPassword(int id,String password){
                        //stmt = c.createStatement();
                        PreparedStatement ps = c.prepareStatement("select id_uzytkownika from uzytkownicy uz join nauczyciele on id_uzytkownika=uz.login where id=?;");
                        ps.setInt(1,id);

                        ResultSet rs = ps.executeQuery();
                        //stmt.close();
                        //stmt = c.createStatement();
                        ps=c.prepareStatement("UPDATE uzytkownicy SET haslo = '"+password+"' where login = '"+userID+"';");
                        ps.setString(1,password);
                        ps.setString(2,userID);
                        ps.executeUpdate();
                        ps.close();
                        return true;
                        return false;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
                        //e.printStackTrace();
                        //System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                        return null;
//                        e.printStackTrace();
//                        System.err.println(e.getClass().getName() + ": " + e.getMessage());
                //System.out.println(Pattern.matches(".*[;].*","adadada;asasas"));
                //ArrayList<Pair<Integer,String> > sub = dbManager.getStudentSubjects("95091673574");
                //for(int i=0;i<sub.size();i++) System.out.println(sub.get(i).getX()+" "+sub.get(i).getY());