CVE-2022-4399 (published 2022-12-10T22:15Z)

A vulnerability was found in TicklishHoneyBee nodau. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/db.c. The manipulation of the argument value/name leads to sql injection. The name of the patch is 7a7d737a3929f335b9717ddbd31db91151b69ad2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215252.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/TicklishHoneyBee/nodau
commit_details: repo_url: https://github.com/TicklishHoneyBee/nodau
author: Omer Dagan
author_date: 2022-03-03 14:02:37+02:00
msg: Use parametetrized SQL statement

Move to parametetrized SQL statement allows using chars like "'" in
notes and also avoid sql injection
repository: repo_url: https://github.com/TicklishHoneyBee/nodau
repo_name: TicklishHoneyBee/nodau
description: a simple console notetaking program
repo_language: C
owner: TicklishHoneyBee
file_changes: filename: CHANGELOG
change_type: ModificationType.MODIFY
diff: @@ -85,3 +85,6 @@ CHANGES:
 	 <mr.omer.dagan <at> gmail.com>)
 	- remove variable definitions in header file that caused issues
 	 with gcc 10
+0.3.10
+    - Move to parametetrized SQL statement allows using chars like "'"
+     in notes, and also avoid sql injection

programming_language: Markdown
filename: db.c
change_type: ModificationType.MODIFY
diff: @@ -285,18 +285,36 @@ int db_update(char* name, char* value)
 	 * if it's meant to be encrypted, then crypt_key will be set */
 	if (crypt_key) {
 		value = note_encrypt(value,crypt_key);
-		r = asprintf(&sql, "UPDATE nodau set text='%s' , encrypted='true' WHERE name='%s'", value, name);
-		free(value);
-		if (r < 0)
+		if (asprintf(&sql, "UPDATE nodau set text=?, encrypted='true' WHERE name=?") < 0)
 			return 1;
 	}else{
-		if (asprintf(&sql, "UPDATE nodau set text='%s' , encrypted='false' WHERE name='%s'", value, name) < 0)
+		if (asprintf(&sql, "UPDATE nodau set text=?, encrypted='false' WHERE name=?") < 0)
 			return 1;
 	}
 
+	sqlite3_stmt *compiled_statement;
+	r = sqlite3_prepare_v2(db_data.db, sql, -1, &compiled_statement, NULL);
+	if (r != SQLITE_OK)
+		return 1;
+
+	r= sqlite3_bind_text(compiled_statement, 1, value, -1, NULL);
+	r= sqlite3_bind_text(compiled_statement, 2, name, -1, NULL);
+	if (r != SQLITE_OK)
+		return 1;
+
 	/* do it */
-	r = sqlite3_exec(db_data.db, sql, NULL, 0, &db_data.error_msg);
+	r = sqlite3_step(compiled_statement);
+	if (r != SQLITE_DONE) {
+		fprintf(stderr, "Error #%d: %s\n", r, db_err());
+		return 1;
+	}
+	r = sqlite3_finalize(compiled_statement);
+	if (r != SQLITE_OK)
+		fprintf(stderr, "Error #%d: %s\n", r, db_err());
+
 	free(sql);
+	if (crypt_key)
+		free(value);
 	return r;
 }
 

programming_language: C
filename: edit.c
change_type: ModificationType.MODIFY
diff: @@ -193,7 +193,8 @@ static int edit_ext(char* editor, char* name, char* date, char* data)
 				if (l) {
 					/* save the note */
 					l += 6;
-					if (db_update(name,l))
+					int r = db_update(name,l);
+					if (r != SQLITE_DONE && r != SQLITE_OK)
 						return 1;
 
 					/* let the user know */

programming_language: C