CVE-2014-125075 (published 2023-01-11T19:15Z)

A vulnerability was found in gmail-servlet and classified as critical. This issue affects the function search of the file src/Model.java. The manipulation leads to sql injection. The identifier of the patch is 5d72753c2e95bb373aa86824939397dc25f679ea. It is recommended to apply a patch to fix this issue. The identifier VDB-218021 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ChrisMcMStone/gmail-servlet
commit_details: repo_url: https://github.com/ChrisMcMStone/gmail-servlet
author: Chris Stone
author_date: 2014-12-17 16:20:57+00:00
msg: Added validation for contact adding and changed use of prepared statements to avoid SQL injection.
repository: repo_url: https://github.com/ChrisMcMStone/gmail-servlet
repo_name: ChrisMcMStone/gmail-servlet
description: Final assignment for SSC uni module
repo_language: Java
owner: ChrisMcMStone
file_changes: filename: AddContact.java
change_type: ModificationType.MODIFY
diff: @@ -45,7 +45,7 @@ public class AddContact extends HttpServlet {
 
                 RequestDispatcher dispatcher = request.getRequestDispatcher("Error"); //New Request Dispatcher
                 request.setAttribute("error", e.getMessage());
-                request.setAttribute("previous", "searchcontact");
+                request.setAttribute("previous", "addcontact.jsp");
                 dispatcher.forward(request, response);
             }
         }

programming_language: Java
filename: Error.java
change_type: ModificationType.MODIFY
diff: @@ -11,9 +11,7 @@ public class Error extends HttpServlet {
      * Calls doPost
      */
     protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
-
         doPost(request, response);
-
     }
 
     /**
@@ -21,20 +19,8 @@ public class Error extends HttpServlet {
      */
     protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
 
-        if (System.currentTimeMillis() > (request.getSession().getLastAccessedTime() + 300000)) {
-            request.setAttribute("error", "Login session timed out, please click retry to log back in");
-            request.setAttribute("previous", "index.html");
-        }
         PrintWriter out = response.getWriter();    //Gets the PrintWriter
-        String back;
-        String previous = (String) request.getAttribute("previous");
-        if (previous.equals("/LoginController") || previous.equals("index.html")) {
-            back = "index.html";
-        } else if (previous.equals("searchcontact")) {
-            back = "contact.jsp";
-        } else {
-            back = "email.html";
-        }
+        String back = (String) request.getAttribute("previous");
         out.println(
                 "<!DOCTYPE html>" +
                         "<html>" +
@@ -56,7 +42,5 @@ public class Error extends HttpServlet {
                         "</body>" +
                         "</html>"
         );
-
     }
-
 }

programming_language: Java
filename: Login.java
change_type: ModificationType.MODIFY
diff: @@ -50,7 +50,7 @@ public class Login extends HttpServlet {
         } catch (MessagingException e) {
             RequestDispatcher dispatcher = request.getRequestDispatcher("Error"); //New Request Dispatcher
             request.setAttribute("error", e.getMessage());
-            request.setAttribute("previous", request.getServletPath());
+            request.setAttribute("previous", "index.html");
             dispatcher.forward(request, response);
         }
     }

programming_language: Java
filename: Model.java
change_type: ModificationType.MODIFY
diff: @@ -48,36 +48,56 @@ public class Model {
         String query;
         if (forename.isEmpty() && surname.isEmpty()) {
             query = "";
-        } else if(forename.isEmpty()) {
+        } else if (forename.isEmpty()) {
             query = "familyname LIKE '%" + surname + "' and";
-        } else if(surname.isEmpty()) {
+        } else if (surname.isEmpty()) {
             query = "forename LIKE '%" + forename + "' and ";
         } else {
             query = "forename LIKE '%" + forename + "' and familyname LIKE '%" + surname + "' and";
         }
 
-    PreparedStatement ps = conn.prepareStatement("SELECT * FROM contactinfo WHERE " + query + " contactemailaddress = '" + contactemail + "'");
-    ResultSet rs = ps.executeQuery();
-    StringBuilder result = new StringBuilder("<h3>Search results...</h3><table class=\"result-table\">" +
-            "<tr>" +
-            "<th>Forename</th> <th>Surname</th> <th>Email</th>" +
-            "</tr>");
-    while(rs.next())
-
-    {
-        result.append("<tr><td>");
-        result.append(rs.getString(2));
-        result.append("</td><td>" + rs.getString(3));
-        result.append("</td><td>" + rs.getString(4) + "</td></tr>");
-    }
+        PreparedStatement ps = conn.prepareStatement("SELECT * FROM contactinfo WHERE ? contactemailaddress = ?");
+        ps.setString(1, query);
+        ps.setString(2, contactemail);
+        ResultSet rs = ps.executeQuery();
+        StringBuilder result = new StringBuilder("<h3>Search results...</h3><table class=\"result-table\">" +
+                "<tr>" +
+                "<th>Forename</th> <th>Surname</th> <th>Email</th>" +
+                "</tr>");
+        while (rs.next())
+        {
+            result.append("<tr><td>");
+            result.append(rs.getString(2));
+            result.append("</td><td>" + rs.getString(3));
+            result.append("</td><td>" + rs.getString(4) + "</td></tr>");
+        }
 
-    result.append("</table");
-    return result.toString();
-}
+        result.append("</table");
+        conn.close();
+        return result.toString();
+    }
 
     public void addContact(String firstname, String surname, String email, String user) throws SQLException {
+
+        PreparedStatement checkDuplicate = conn.prepareStatement("SELECT * FROM contactinfo WHERE emailaddress = ?");
+        checkDuplicate.setString(1, email);
+        ResultSet rs = checkDuplicate.executeQuery();
+        if (rs.next()) {
+            throw new SQLException("Contact already exists");
+        }
         PreparedStatement newStudent = conn.prepareStatement("INSERT INTO " +
-                "contactinfo (forename, familyname, emailaddress, contactemailaddress) VALUES ('" + firstname + "', '" + surname + "', '" + email + "', '" + user + "')");
+                "contactinfo (forename, familyname, emailaddress, contactemailaddress) VALUES (?, ?, ?, ?)");
+        newStudent.setString(1, firstname);
+        newStudent.setString(2, surname);
+        newStudent.setString(3, email);
+        newStudent.setString(4, user);
         newStudent.execute();
+
+        conn.close();
     }
 }
+
+
+//Todo sort out errors, when logging in unsuccessfully etc
+//Todo format message sent successfully page
+//Todo add some JS to allow user to click search results and send an email to that address

programming_language: Java
filename: SearchContact.java
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,7 @@ public class SearchContact extends HttpServlet {
             } catch (SQLException e) {
                 RequestDispatcher dispatcher = request.getRequestDispatcher("Error"); //New Request Dispatcher
                 request.setAttribute("error", e.getMessage());
-                request.setAttribute("previous", "searchcontact");
+                request.setAttribute("previous", "contact.jsp");
                 dispatcher.forward(request, response);
             }
         }

programming_language: Java
filename: addcontact.jsp
change_type: ModificationType.MODIFY
diff: @@ -12,7 +12,7 @@
     </script>
 </head>
 <body>
-<a id="back" href="http://<%=request.getServerName()%>:<%=request.getServerPort()%>/email.html">Back</a>
+<a id="back" href="email.html">Back</a>
 <div class="logout-container">
     <form action="logout" method="post">
         <input id="logout" type="submit" value="Log Out"/>
@@ -28,7 +28,7 @@
                     <b>Forename: </b>
                 </td>
                 <td>
-                    <input id="name" name="firstname" type="text" placeholder="...">
+                    <input id="name" name="firstname" type="text" placeholder="..." required>
                 </td>
             </tr>
             <tr>
@@ -44,7 +44,7 @@
                     <b>Email Address: </b>
                 </td>
                 <td>
-                    <input id="email" name="email" type="email" placeholder="...">
+                    <input id="email" name="email" type="email" placeholder="..." required>
                 </td>
             </tr>
             <tr>

programming_language: HTML
filename: contact.jsp
change_type: ModificationType.MODIFY
diff: @@ -11,7 +11,7 @@
     </script>
 </head>
 <body>
-<a id="back" href="http://<%=request.getServerName()%>:<%=request.getServerPort()%>/email.html">Back</a>
+<a id="back" href="email.html">Back</a>
 <div class="logout-container">
     <form action="logout" method="post">
         <input id="logout" type="submit" value="Log Out"/>

programming_language: HTML