CVE-2014-125074 (published 2023-01-11T15:15Z)

A vulnerability was found in Nayshlok Voyager. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file Voyager/src/models/DatabaseAccess.java. The manipulation leads to sql injection. The identifier of the patch is f1249f438cd8c39e7ef2f6c8f2ab76b239a02fae. It is recommended to apply a patch to fix this issue. The identifier VDB-218005 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Nayshlok/Voyager
commit_details: repo_url: https://github.com/Nayshlok/Voyager
author: Nayshlok
author_date: 2014-11-17 15:30:35-07:00
msg: fixed problems in register controller, and worked at preventing sql-injection in database access
repository: repo_url: https://github.com/Nayshlok/Voyager
repo_name: Nayshlok/Voyager
repo_language: Java
owner: Nayshlok
file_changes: filename: login.jsp
change_type: ModificationType.MODIFY
diff: @@ -26,13 +26,13 @@
 
 	<article class="bodyContainer">
 		<h1>Register</h1>
-		<p><%= (request.getAttribute("errorMessage") == null ? "" : request.getAttribute("errorMessage")) %></p>
 		<form method="get" action="<%=request.getContextPath()%>/register">
 			<input type="submit" value="Register" id="submit" />
 		</form>
 		<br /> <br />
 		<hr />
 		<h1>Login</h1>
+		<p><%= (request.getAttribute("errorMessage") == null ? "" : request.getAttribute("errorMessage")) %></p>
 		<form method="post">
 			<label>Username:</label> <input name="username" /> <label>Password:</label>
 			<input name="password" type="password" /> <input type="submit"

programming_language: HTML
filename: register.jsp
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,7 @@
 	</header>
 	<article class="bodyContainer">
 		<h1>Register New User</h1>
-		<p><%=(((RegisterUserModel)request.getAttribute("errorMessage")).getErrorMessage() == null ? "" : ((RegisterUserModel)request.getAttribute("errorMessage")).getErrorMessage()) %></p>
+		<p><%=(request.getAttribute("errorMessage") == null ? "" : request.getAttribute("errorMessage")) %></p>
 		<form method="post" enctype="multipart/form-data">
 			<label>Username:</label> <input name="username" type="text" value="<%= current.getUsername() %>"/>
 			<label>Password:</label><input	name="password" type="password" /> 

programming_language: HTML
filename: RegisterController.java
change_type: ModificationType.MODIFY
diff: @@ -55,14 +55,12 @@ public class RegisterController {
 		ModelAndView mv = null;
 		
 		if(!password.equals(confirmPassword)) {
-			model.setErrorMessage("Bad username/password. ");
 			request.setAttribute("attemptedAccount", new Account(username, email, avatarPath, Roles.User, password));
-			mv = new ModelAndView(model, "/WEB-INF/register.jsp");
+			mv = new ModelAndView("Passwords did not match", "/WEB-INF/register.jsp");
 		}
 		if(!email.equals(confirmEmail)){
-			model.setErrorMessage(model.getErrorMessage() + "Emails did not match. ");
 			request.setAttribute("attemptedAccount", new Account(username, email, avatarPath, Roles.User, password));
-			mv = new ModelAndView(model, "/WEB-INF/register.jsp");
+			mv = new ModelAndView("Emails did not match. ", "/WEB-INF/register.jsp");
 		}
 		try {
 			Account user = new Account(username, email, avatarPath, Roles.User, password);
@@ -72,8 +70,7 @@ public class RegisterController {
 			mv = new ModelAndView(model, "/WEB-INF/account/profile.jsp");
 		} catch(UsernameAlreadyExistsException e) {
 			request.setAttribute("attemptedAccount", new Account(username, email, avatarPath, Roles.User, password));
-			model.setErrorMessage("Username has already been used.");
-			mv = new ModelAndView(model, "/WEB-INF/register.jsp");
+			mv = new ModelAndView("Username has already been used.", "/WEB-INF/register.jsp");
 		} catch (ServletException e) {
 			e.printStackTrace();
 		} catch (IOException e) {

programming_language: Java
filename: DatabaseAccess.java
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,7 @@ import exceptions.UsernameAlreadyExistsException;
 
 public class DatabaseAccess implements DataService {
 
+	private final String connectionUrl = "jdbc:sqlserver://n8bu1j6855.database.windows.net:1433;database=VoyagerDB;user=VoyageLogin@n8bu1j6855;password={GroupP@ssword};encrypt=true;hostNameInCertificate=*.database.windows.net;loginTimeout=30;";
 	/* (non-Javadoc)
 	 * @see models.DataService#login(java.lang.String, java.lang.String)
 	 */
@@ -22,10 +23,10 @@ public class DatabaseAccess implements DataService {
 	public Account login(String username, String password){
 		Account account = null;
 		Driver driver = new SQLServerDriver();
-		String connectionUrl = "jdbc:sqlserver://n8bu1j6855.database.windows.net:1433;database=VoyagerDB;user=VoyageLogin@n8bu1j6855;password={GroupP@ssword};encrypt=true;hostNameInCertificate=*.database.windows.net;loginTimeout=30;";
 		try {
 			Connection con = driver.connect(connectionUrl, new Properties());
-			PreparedStatement statement = con.prepareStatement("Select userName, userPassword, userEmail, userRole from UserTable where userName = '" + username + "'");
+			PreparedStatement statement = con.prepareStatement("Select userName, userPassword, userEmail, userRole from UserTable where userName = ?");
+			statement.setString(1, username);
 			ResultSet rs = statement.executeQuery();
 			rs.next();
 			String storedPass = rs.getString("userPassword");
@@ -55,11 +56,14 @@ public class DatabaseAccess implements DataService {
 	@Override
 	public void registerUser(Account user){
 		Driver driver = new SQLServerDriver();
-		String connectionUrl = "jdbc:sqlserver://n8bu1j6855.database.windows.net:1433;database=VoyagerDB;user=VoyageLogin@n8bu1j6855;password={GroupP@ssword};encrypt=true;hostNameInCertificate=*.database.windows.net;loginTimeout=30;";
 		try {
 			Connection con = driver.connect(connectionUrl, new Properties());
 			PreparedStatement statement = con.prepareStatement("Insert INTO UserTable (userName, userPassword, userEmail, userRole) "
-					+ "VALUES ('" + user.getUsername() + "', '" + user.getPassword() + "', '" + user.getEmail() + "', '" + user.getRole().toString() + "');");
+					+ "VALUES (?, ?, ?, ?);");
+			statement.setString(1, user.getUsername());
+			statement.setString(2, user.getPassword());
+			statement.setString(3, user.getEmail());
+			statement.setString(4, user.getRole().toString());
 			statement.execute();
 			System.out.println("Registration Successful");
 		} catch (SQLException e) {
@@ -79,10 +83,10 @@ public class DatabaseAccess implements DataService {
 	@Override
 	public void removeUser(Account user){
 		Driver driver = new SQLServerDriver();
-		String connectionUrl = "jdbc:sqlserver://n8bu1j6855.database.windows.net:1433;database=VoyagerDB;user=VoyageLogin@n8bu1j6855;password={GroupP@ssword};encrypt=true;hostNameInCertificate=*.database.windows.net;loginTimeout=30;";
 		try {
 			Connection con = driver.connect(connectionUrl, new Properties());
-			PreparedStatement statement = con.prepareStatement("DELETE FROM UserTable WHERE userName='" + user.getUsername() + "'");
+			PreparedStatement statement = con.prepareStatement("DELETE FROM UserTable WHERE userName=?");
+			statement.setString(1, user.getUsername());
 			statement.execute();
 			System.out.println("Removal sucessful");
 		} catch (SQLException e) {
@@ -96,17 +100,20 @@ public class DatabaseAccess implements DataService {
 	@Override
 	public void updateUser(Account user){
 		Driver driver = new SQLServerDriver();
-		String connectionUrl = "jdbc:sqlserver://n8bu1j6855.database.windows.net:1433;database=VoyagerDB;user=VoyageLogin@n8bu1j6855;password={GroupP@ssword};encrypt=true;hostNameInCertificate=*.database.windows.net;loginTimeout=30;";
 		try {
 			Connection con = driver.connect(connectionUrl, new Properties());
 			PreparedStatement statement = con.prepareStatement("UPDATE UserTable "
-					+ "SET userPassword='" + user.getPassword() + "', userEmail='" + user.getEmail() + "', userRole='" + user.getRole().toString() + "'"
-					+ "WHERE userName='" + user.getUsername() + "'");
+					+ "SET userPassword=?, userEmail=?, userRole=?"
+					+ "WHERE userName=?");
+			statement.setString(1, user.getPassword());
+			statement.setString(2, user.getEmail());
+			statement.setString(3, user.getRole().toString());
+			statement.setString(4, user.getUsername());
 			statement.execute();
 			System.out.println("Update successful");
 		} catch (SQLException e) {
 			e.printStackTrace();
-		}	
+		}
 	}
 	
 	/* (non-Javadoc)
@@ -114,13 +121,12 @@ public class DatabaseAccess implements DataService {
 	 */
 	@Override
 	public int getUserId(String user){
-		Account account = null;
 		int id = -1;
 		Driver driver = new SQLServerDriver();
-		String connectionUrl = "jdbc:sqlserver://n8bu1j6855.database.windows.net:1433;database=VoyagerDB;user=VoyageLogin@n8bu1j6855;password={GroupP@ssword};encrypt=true;hostNameInCertificate=*.database.windows.net;loginTimeout=30;";
 		try {
 			Connection con = driver.connect(connectionUrl, new Properties());
-			PreparedStatement statement = con.prepareStatement("Select userId from UserTable where userName = '" + user + "'");
+			PreparedStatement statement = con.prepareStatement("Select userId from UserTable where userName = ?");
+			statement.setString(1, user);
 			ResultSet rs = statement.executeQuery();
 			rs.next();
 			String storedId = rs.getString("userId");
@@ -138,10 +144,10 @@ public class DatabaseAccess implements DataService {
 	public String getUserName(int userId){
 		String userName = null;
 		Driver driver = new SQLServerDriver();
-		String connectionUrl = "jdbc:sqlserver://n8bu1j6855.database.windows.net:1433;database=VoyagerDB;user=VoyageLogin@n8bu1j6855;password={GroupP@ssword};encrypt=true;hostNameInCertificate=*.database.windows.net;loginTimeout=30;";
 		try {
 			Connection con = driver.connect(connectionUrl, new Properties());
-			PreparedStatement statement = con.prepareStatement("Select userName from UserTable where userId = '" + userId + "'");
+			PreparedStatement statement = con.prepareStatement("Select userName from UserTable where userId = ?");
+			statement.setInt(1, userId);
 			ResultSet rs = statement.executeQuery();
 			rs.next();
 			userName = rs.getString("userName");
@@ -159,18 +165,20 @@ public class DatabaseAccess implements DataService {
 	@Override
 	public void enterPost(Post post){
 		Driver driver = new SQLServerDriver();
-		String connectionUrl = "jdbc:sqlserver://n8bu1j6855.database.windows.net:1433;database=VoyagerDB;user=VoyageLogin@n8bu1j6855;password={GroupP@ssword};encrypt=true;hostNameInCertificate=*.database.windows.net;loginTimeout=30;";
 		try {
 			Connection con = driver.connect(connectionUrl, new Properties());
 			PreparedStatement statement = con.prepareStatement("Insert INTO PostTable (postTitle, postAuthorId, postTime, postContent) "
 					+ "VALUES ('" + post.getTitle() + "', '" + this.getUserId(post.getAuthor()) + "', CURRENT_TIMESTAMP, '" + post.getMessage() + "');");
+			statement.setString(1, post.getTitle());
+			statement.setInt(2, this.getUserId(post.getAuthor()));
+			statement.setString(3, post.getMessage());
 			statement.execute();
 			System.out.println("Successful post");
 		} catch (SQLException e) {
 			e.printStackTrace();
 		}	
 	}
-	
+
 	/* (non-Javadoc)
 	 * @see models.DataService#retrievePost(java.lang.String)
 	 */
@@ -178,7 +186,6 @@ public class DatabaseAccess implements DataService {
 	public Post retrievePost(String postTitle){
 		Post post = null;
 		Driver driver = new SQLServerDriver();
-		String connectionUrl = "jdbc:sqlserver://n8bu1j6855.database.windows.net:1433;database=VoyagerDB;user=VoyageLogin@n8bu1j6855;password={GroupP@ssword};encrypt=true;hostNameInCertificate=*.database.windows.net;loginTimeout=30;";
 		try {
 			Connection con = driver.connect(connectionUrl, new Properties());
 			PreparedStatement statement = con.prepareStatement("Select postTitle, postAuthorId, postTime, postContent from PostTable where postTitle = '" + postTitle + "'");

programming_language: Java