CVE-2014-125061 (Ruby, published 2023-01-07T13:15Z)
Description: value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in peel filebroker and classified as critical. Affected by this issue is the function select_transfer_status_desc of the file lib/common.rb. The manipulation leads to sql injection. The name of the patch is 91097e26a6c84d3208a351afaa52e0f62e5853ef. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217616. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/peel/filebroker
Files changed:
lib/common.rb
lib/filebroker.rb
public/filebroker_service.xsd
Commit message: filter out transferred + sql injection fixes


Vulnerable code:
    @db.exec("INSERT into fb_file_status (transfer_id, filename, status_id, status_time) VALUES (#{transfer_id}, '#{file}', #{status_id}, '#{status_time}')")
    if @db.exec("SELECT * FROM fb_file_status WHERE transfer_id=#{transfer_id} AND filename='#{file}'").count > 0
      @db.exec("UPDATE fb_file_status SET status_id=#{status_id}, status_time='#{status_time}' WHERE transfer_id=#{transfer_id} AND filename='#{file}'")
      fb_file_status.transfer_id = #{transfer_id}
    @db.exec(sql)
      # Remove currently transferred files

Fixed code:
    sql = "INSERT into fb_file_status (transfer_id, filename, status_id, status_time) VALUES ($1::int, $2::text, $3::int, $4::timestamp)"
    @db.exec(sql, [transfer_id, file, status_id, status_time])
    sql_count = "SELECT * FROM fb_file_status WHERE transfer_id=$1::int AND filename=$2::text"
    if @db.exec(sql_count, [transfer_id, file]).count > 0
      sql_update = "UPDATE fb_file_status SET status_id=$1::int, status_time=$2::timestamp WHERE transfer_id=$3::int AND filename=$4::text"
      @db.exec(sql_update, [status_id, status_time, transfer_id, file])
  def select_files_by_transfer_status(status_id, source_id, source_path, file_name)
    sql = "
    SELECT 
      fb_transfer.transfer_id, 
      fb_file_status.filename,
      fb_file_status.status_time
    FROM 
        fb_transfer, fb_transfer_status, public.fb_file_status
    WHERE fb_transfer.source_id = $1::bigint 
      AND fb_transfer_status.status_id = $2::int
      AND fb_transfer.source_path = $3::text
      AND fb_transfer.transfer_id = fb_transfer_status.transfer_id
      AND fb_file_status.filename = $4::text
      AND fb_file_status.transfer_id = fb_transfer.transfer_id"
    @db.exec(sql, [source_id, status_id, source_path, file_name])
  end

      fb_file_status.transfer_id = $1::int
    @db.exec(sql, [transfer_id])
      req['filter_out_transferred'] = soap_body.xpath("//#{prefix}:FilterOutTransferred/text()").to_s
      # Remove currently transferring files
      # Remove already transferred files - optional depends on FilterOutTransferred option
      if source['filter_out_transferred'] == 'true'
        list.delete_if { |k| 
          @db.select_files_by_transfer_status(FBService::TRANSFER_COMPLETED_SUCCESSFULLY, source['account_id'], source['path'], k['name']).ntuples() > 0
        }
      end

      <xs:element name="FilterOutTransferred" type="xs:boolean" minOccurs="0" maxOccurs="1" />