CVE-2015-10035 (published 2023-01-09T21:15Z)

A vulnerability was found in gperson angular-test-reporter and classified as critical. This issue affects the function getProjectTables/addTest of the file rest-server/data-server.js. The manipulation leads to sql injection. The patch is named a29d8ae121b46ebfa96a55a9106466ab2ef166ae. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217715.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/gperson/angular-test-reporter
commit_details: repo_url: https://github.com/gperson/angular-test-reporter
author: gperson
author_date: 2015-01-07 21:30:05-06:00
msg: Escaping to prevent sql injections & others issues
repository: repo_url: https://github.com/gperson/angular-test-reporter
repo_name: gperson/angular-test-reporter
description: App for posting and viewing automated test results, using AngularJS and node Rest server
repo_language: JavaScript
owner: gperson
file_changes: filename: app.js
change_type: ModificationType.MODIFY
diff: @@ -30,7 +30,7 @@ app.controller('projectCtrl', function($scope, $location, $http, myFactory) {
 	$scope.switchProject = function(project){
 		myFactory.set(project);
 		$scope.project.name = project.substring(6);
-		$location.path('/app/index.html#/view1');
+		$location.path('/app/index.html#/tests');
 	};
 });
 

programming_language: JavaScript
filename: data-server.js
change_type: ModificationType.MODIFY
diff: @@ -135,7 +135,8 @@ function getProjectTables(response){
  */
 function addNote(request, response, note){
 	var parts = url.parse(request.url,true);
-	var query = connection.query("INSERT INTO notes_"+(parts.query.table).substring(6)+" (testId,who,note) VALUES ("+note.testId+",'" + note.who + "','"+note.note+"')", function(err, rows, fields) {
+	var queryStr = "INSERT INTO notes_"+(parts.query.table).substring(6)+" (testId,who,note) VALUES ("+connection.escape(note.testId)+"," + connection.escape(note.who) + ","+connection.escape(note.note)+")";
+	var query = connection.query(queryStr,function(err, rows, fields) {
 		if (err) {
 			response.statusCode = 400;
 			console.log(err);
@@ -163,7 +164,7 @@ function addTest(request, response, body){
 	start = start.getFullYear()+"-"+(start.getMonth()+1)+"-"+start.getDate()+" "+start.getHours()+":"+start.getMinutes()+":"+start.getSeconds();
 	end = end.getFullYear()+"-"+(end.getMonth()+1)+"-"+end.getDate()+" "+end.getHours()+":"+end.getMinutes()+":"+end.getSeconds();
 
-	var queryStr = "INSERT INTO "+table+" (name,param,error,start,end,status,extra,runInfo) VALUES ('"+test.name+"','" + test.param + "','"+test.error+ "','"+start+ "','"+end+ "','"+test.status+ "','"+test.extra+ "','"+test.runInfo+"')";
+	var queryStr = "INSERT INTO "+table+" (name,param,error,start,end,status,extra,runInfo) VALUES ("+connection.escape(test.name)+"','" + connection.escape(test.param) + ","+connection.escape(test.error)+ "','"+start+ "','"+end+ "',"+connection.escape(test.status)+ ","+connection.escape(test.extra)+ ","+connection.escape(test.runInfo)+")";
 	var query = connection.query(queryStr, function(err, rows, fields) {
 		if (err) {
 			response.statusCode = 400;

programming_language: JavaScript