CVE-2014-125038 (published 2023-01-02T18:15Z)

A vulnerability has been found in IS_Projecto2 and classified as critical. This vulnerability affects unknown code of the file Cnn-EJB/ejbModule/ejbs/NewsBean.java. The manipulation of the argument date leads to sql injection. The name of the patch is aa128b2c9c9fdcbbf5ecd82c1e92103573017fe0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217192.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/rfsimoes/IS_Projecto2
commit_details: repo_url: https://github.com/rfsimoes/IS_Projecto2
author: André Dinis
author_date: 2014-11-12 14:48:28+00:00
msg: data a funcionar mas sem proteger sql injection
repository: repo_url: https://github.com/rfsimoes/IS_Projecto2
repo_name: rfsimoes/IS_Projecto2
repo_language: Java
owner: rfsimoes
file_changes: filename: NewsBean.java
change_type: ModificationType.MODIFY
diff: @@ -93,8 +93,8 @@ public class NewsBean implements NewsBeanRemote {
      * @return lista de notcias ordenadas
      */
     public List<News> newsMoreRecentThan(String date){
-    	Query query = em.createQuery("SELECT n FROM News n WHERE n.date > :d ORDER BY date DESC");
-    	query.setParameter("d", date);
+    	Query query = em.createQuery("SELECT n FROM News n WHERE n.date > '"+date+"' ORDER BY date DESC");
+    	//query.setParameter("d", date);
     	
     	@SuppressWarnings("unchecked")
 		List<News> news = query.getResultList();
@@ -103,9 +103,9 @@ public class NewsBean implements NewsBeanRemote {
     }
     
     public List<News> newsMoreRecentThan(String date, String region){
-    	Query query = em.createQuery("SELECT n FROM News n WHERE n.region LIKE :r AND n.date > :d ORDER BY date DESC");
+    	Query query = em.createQuery("SELECT n FROM News n WHERE n.region LIKE :r AND n.date > '"+date+"' ORDER BY date DESC");
     	query.setParameter("r", region);
-    	query.setParameter("d", date);
+    	//query.setParameter("d", date);
     	
     	@SuppressWarnings("unchecked")
 		List<News> news = query.getResultList();

programming_language: Java
filename: AllNews.jsp
change_type: ModificationType.MODIFY
diff: @@ -113,9 +113,6 @@
 								<div class="panel-body">
 									<!-- Autor(es) -->
 									<!-- 
-									<c:set var="string2" value="This is second String."/>
-									<c:set var="numAuthors" value="${fn:length(string2)}"/>
-									<p>Length of String (2) : ${numAuthors}</p>
 									
 							  		<c:if test="${numAuthors > 0}">
  							  			by 
@@ -131,7 +128,7 @@
 											</c:otherwise>
 										</c:choose>
 									</c:if>
-									 -->
+									-->
 									<!-- Data -->
  									on 
  									<fmt:formatDate pattern="yyyy/MM/dd HH:mm" value="${news.date}" />

programming_language: HTML
filename: DateNews.jsp
change_type: ModificationType.MODIFY
diff: @@ -54,6 +54,7 @@
 		
 		<% 
 			String date = session.getAttribute("date").toString();
+			//System.out.println("DATA: " + date);
 		%>
 		<h1>News more recent than <%= date %></h1>
 		

programming_language: HTML
filename: Menu.jsp
change_type: ModificationType.MODIFY
diff: @@ -112,7 +112,7 @@
         
         <form action="DateNewsServlet" method="GET" id="login_form" onsubmit="return validateForm('date')">
 				<p>
-					List news more recent than <input type="text" name="date" id="date" />
+					List news more recent than <input type="datetime-local" name="date" id="date" />
 					<input type="SUBMIT" value="Ok" />
 				</p>
 		</form>

programming_language: HTML