CVE-2015-10014 (Ruby, published 2023-01-05T14:15Z)
Description: value: A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identifier of the patch is 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f. It is recommended to apply a patch to fix this issue. The identifier VDB-217485 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/arekk/uke
Files changed:
lib/uke/finder.rb
Commit message: SQL injection possibility


Vulnerable code:
    sql.gsub!(':lat_ne', conn.quote_string(bounds_ne['lat'].to_s))
    sql.gsub!(':lat_sw', conn.quote_string(bounds_sw['lat'].to_s))
    sql.gsub!(':lon_ne', conn.quote_string(bounds_ne['lng'].to_s))
    sql.gsub!(':lon_sw', conn.quote_string(bounds_sw['lng'].to_s))
    sql.gsub!(':lat', conn.quote_string(@location.latitude.to_s))
    sql.gsub!(':lon', conn.quote_string(@location.longitude.to_s))
    sql.gsub!(':lat_ne', conn.quote_string(bounds_ne['lat'].to_s))
    sql.gsub!(':lat_sw', conn.quote_string(bounds_sw['lat'].to_s))
    sql.gsub!(':lon_ne', conn.quote_string(bounds_ne['lng'].to_s))
    sql.gsub!(':lon_sw', conn.quote_string(bounds_sw['lng'].to_s))
    sql.gsub!(':lat', conn.quote_string(@location.latitude.to_s))
    sql.gsub!(':lon', conn.quote_string(@location.longitude.to_s))
    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':mhz_start', conn.quote_string(first.to_s)).gsub(':mhz_end', conn.quote_string(last.to_s)))
    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':mhz', conn.quote_string(Uke::Unifier::frq_string(@q).to_s)))
           AND (us.location LIKE '%:like%' OR us.name LIKE '%:like%' OR uo.name LIKE '%:like%')
    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':like', conn.quote_string(@q)))
    result_to_hash(conn.select_all(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':lat', conn.quote_string(@location.latitude.to_s)).gsub(':lon', conn.quote_string(@location.longitude.to_s)).gsub(':mhz', conn.quote_string(Uke::Unifier::frq_string(@q).to_s))))

Fixed code:
    sql.gsub!(':lat_ne', conn.quote(bounds_ne['lat'].to_s))
    sql.gsub!(':lat_sw', conn.quote(bounds_sw['lat'].to_s))
    sql.gsub!(':lon_ne', conn.quote(bounds_ne['lng'].to_s))
    sql.gsub!(':lon_sw', conn.quote(bounds_sw['lng'].to_s))
    sql.gsub!(':lat', conn.quote(@location.latitude.to_s))
    sql.gsub!(':lon', conn.quote(@location.longitude.to_s))
    sql.gsub!(':lat_ne', conn.quote(bounds_ne['lat'].to_s))
    sql.gsub!(':lat_sw', conn.quote(bounds_sw['lat'].to_s))
    sql.gsub!(':lon_ne', conn.quote(bounds_ne['lng'].to_s))
    sql.gsub!(':lon_sw', conn.quote(bounds_sw['lng'].to_s))
    sql.gsub!(':lat', conn.quote(@location.latitude.to_s))
    sql.gsub!(':lon', conn.quote(@location.longitude.to_s))
    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':mhz_start', conn.quote(first.to_s)).gsub(':mhz_end', conn.quote(last.to_s)))
    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':mhz', conn.quote(Uke::Unifier::frq_string(@q).to_s)))
           AND (us.location LIKE :like OR us.name LIKE :like OR uo.name LIKE :like)
    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':like', conn.quote('%'+@q.to_s+'%')))
    result_to_hash(conn.select_all(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':lat', conn.quote(@location.latitude.to_s)).gsub(':lon', conn.quote(@location.longitude.to_s)).gsub(':mhz', conn.quote(Uke::Unifier::frq_string(@q).to_s))))