CVE-2015-10048 (published 2023-01-15T10:15Z)

A vulnerability was found in bmattoso desafio_buzz_woody. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is cb8220cbae06082c969b1776fcb2fdafb3a1006b. It is recommended to apply a patch to fix this issue. The identifier VDB-218357 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/bmattoso/desafio_buzz_woody
commit_details: repo_url: https://github.com/bmattoso/desafio_buzz_woody
author: Bruno Mattoso Gonçalves
author_date: 2015-02-09 00:18:57-02:00
msg: Método de execute alterado para SQLINJECTION , faltando apenas o método de StoredProcedure
repository: repo_url: https://github.com/bmattoso/desafio_buzz_woody
repo_name: bmattoso/desafio_buzz_woody
repo_language: JavaScript
owner: bmattoso
file_changes: filename: Database.java
change_type: ModificationType.MODIFY
diff: @@ -1,11 +1,15 @@
 package com.dextra.injectit.database;
 
+import java.sql.CallableStatement;
 import java.sql.Connection;
 import java.sql.DriverManager;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Statement;
 
+import sun.security.provider.ConfigFile.Spi;
+
 public class Database {
 
 	private Database() {
@@ -19,23 +23,63 @@ public class Database {
 		}
 	}
 
+	public static ResultSet executeStoredPrcedure(String spCalled, Object... parameters){
+		Connection conn = getConnection();
+		CallableStatement cs = null;
+
+		try {
+			cs = conn.prepareCall(spCalled);
+			if (parameters != null)
+				for (int parameterIndex = 0; parameterIndex < parameters.length; ++parameterIndex){
+					cs.setObject(parameterIndex + 1, parameters[parameterIndex]);
+				}
+			System.out.println(cs.toString());
+			if (cs.execute())
+				return  cs.executeQuery();	
+			else 
+				return null;
+		} catch (SQLException e) {
+		
+			throw new RuntimeException(e);
+		
+		} finally {
+			try {
+				if (cs != null) {
+					cs.close();
+				}
+				conn.close();
+			} catch (SQLException e) {
+				throw new RuntimeException(e);
+			}
+		}
+	}
+	
 	public static ResultSet execute(String sql, Object... objects) {
 		Connection conn = getConnection();
-		Statement s = null;
+		PreparedStatement ps = null;
 		
 		try {
-			s = conn.createStatement();
-			if (s.execute(sql)) {
-				return s.getResultSet();
-			} else {
+			System.out.println(sql);
+			ps = conn.prepareStatement(sql);
+			
+			// Set the parameters
+			if (objects != null)
+				for (int parameterIndex = 0; parameterIndex < objects.length; ++parameterIndex){
+					ps.setObject(parameterIndex + 1, objects[parameterIndex]);
+				}
+			
+			if (ps.execute())
+				return ps.getResultSet();
+			else
 				return null;
-			}
+			
 		} catch (SQLException e) {
+			e.printStackTrace();
 			throw new RuntimeException(e);
 		} finally {
 			try {
-				if (s != null) {
-					s.close();
+				if (ps != null) {
+					ps.close();
 				}
 				conn.close();
 			} catch (SQLException e) {

programming_language: Java
filename: MockDatabase.java
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,14 @@ public class MockDatabase {
 				+ "password VARCHAR(100) NOT NULL, "
 				+ "creditCardNumber VARCHAR(12) NOT NULL)";
 		Database.execute(create);
+		
+		String sp = "CREATE PROCEDURE sp_getUser "
+				+ "(@user VARCHAR(100)) "
+				+ "AS "
+				+ "BEGIN "
+				+ "SELECT * FROM USER WHERE NAME = @user "
+				+ "END";
+		Database.execute(sp);
 
 		insertUser("Guilherme", "EuAmoGatinhos", "123456789012");
 		insertUser("Bruno", "LaFooon", "187456779012");

programming_language: Java
filename: InjectServlet.java
change_type: ModificationType.MODIFY
diff: @@ -12,6 +12,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import com.dextra.injectit.database.Database;
+import com.dextra.injectit.database.MockDatabase;
 import com.dextra.injectit.database.User;
 import com.google.gson.Gson;
 
@@ -66,9 +67,11 @@ public class InjectServlet extends HttpServlet {
 		
 		// Nome dos usuario pesquisado
 		String name = req.getParameter("name");
+		String[] names = new String[1];
+		names[0] = name;
 		
-		String query = "SELECT * FROM USER WHERE NAME = '" + name + "'";
-		ResultSet users = Database.execute(query);
+		String query = "SELECT * FROM USER WHERE NAME = ?";
+		ResultSet users = Database.execute(query,names);
 		
 		ArrayList<User> searchedUsers = new ArrayList<User>();
 		try {
@@ -93,13 +96,19 @@ public class InjectServlet extends HttpServlet {
 	public static void main(String[] args) {
 		/////////////////
 		// TESTE DE SQL INJECTION
+		try {
+			MockDatabase.execute();
+			
+			
+			String query = "{call sp_getUser(?)}";
 		
+			Object []objs = new Object [1];
+			objs[0] = "Jefferson";
+			
+			ResultSet users = Database.executeStoredPrcedure(query, objs);
 		
-		String query = "SELECT * FROM USER WHERE NAME = ?";
-		ResultSet users = Database.execute(query);
+			ArrayList<User> searchedUsers = new ArrayList<User>();
 		
-		ArrayList<User> searchedUsers = new ArrayList<User>();
-		try {
 			
 			while (users.next()){
 				searchedUsers.add(new User(users.getString(1),users.getString(2),users.getString(3)));
@@ -108,7 +117,7 @@ public class InjectServlet extends HttpServlet {
 			Gson gson = new Gson();
 			System.out.println(gson.toJson(searchedUsers));
 
-		} catch (SQLException e) {
+		} catch (Exception e) {
 			e.printStackTrace();
 		}	
 	}

programming_language: Java
filename: index.html
change_type: ModificationType.MODIFY
diff: @@ -2,8 +2,6 @@
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
-<script src="http://code.jquery.com/jquery-2.1.3.js"
-	type="text/javascript"></script>
 </head>
 <body>
 	<label for="search">Nome:</label>
@@ -11,5 +9,10 @@
 	<input type="button" value="Pesquisar" id="pesquisar" />
 	<div id="usuarios">
 	</div>
+	
+	<script src="http://code.jquery.com/jquery-2.1.3.js" type="text/javascript"></script>
+	<script src="js/index.js" type="text/javascript"></script>
+	<script src="js/doT.js" type="text/javascript"></script>
+	
 </body>
 </html>
\ No newline at end of file

programming_language: HTML
filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -1,18 +1,29 @@
-    $.ajax({
-        url : 'api/usuarios',
-        type : "GET",
-    }).done(function(resp) {
-        $("#usuarios").html(resp);
-    });
+$(document).ready(function(){
+	$.ajax({
+		type : 'GET',
+		url : 'api/usuarios',
+		dataType : 'json'
+	}).success(function(strJson) {
+		$.get('templates/template.html').done(function(template) {
+			$('#usuarios').html(doT.template(template)(strJson));
+		});
+	})
+});
 
-    $("#pesquisar").click(function() {
-        $.ajax({
-            url : 'api/usuarios',
-            type : "GET",
-            data : {
-                name : $("#search").val()
-            }
-        }).done(function(resp) {
-            $("#usuarios").html(resp);
-        });
-    });
+$('#pesquisar').click(function() {
+
+	$.ajax({
+		url : 'api/usuarios',
+		type : 'POST',
+		data : {
+			name : $('#search').val()
+		},
+		dataType : 'json'
+	}).done(function(resp) {
+		console.info(resp);
+		$.get('templates/template.html',function (template){
+			$("#usuarios").html(doT.template(template)(resp));
+		}, "html");
+
+	});
+});
\ No newline at end of file

programming_language: JavaScript
filename: template.html
change_type: ModificationType.MODIFY
diff: @@ -6,12 +6,14 @@
 		<th>Numero do cartao: </th>
 	</tr>
 </thead>
-<tbody>
-{{~it : client}}
+<tbody> 
+{{console.info(it);}}
+{{~it :user}}
 <tr>
-	<td>{{=client.name}}</td>
-	<td>{{=client.password}}</td>
-	<td>{{=client.creditCardNumber}}</td>
+	{{console.info();}}
+	<td>{{=user.name}}</td>
+	<td>{{=user.password}}</td>
+	<td>{{=user.creditCardNumber}}</td>
 </tr>
 {{~}}
 </tbody>

programming_language: HTML
filename: pom.properties
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 #Generated by Maven
-#Fri Feb 06 13:33:32 BRST 2015
+#Sun Feb 08 22:05:57 BRST 2015
 version=1.0-SNAPSHOT
 groupId=com.dextra.injectIt
 artifactId=injectIt

programming_language: Batchfile
filename: createdFiles.lst
change_type: ModificationType.MODIFY
diff: @@ -1,11 +1,5 @@
-<<<<<<< HEAD
 com/dextra/injectit/servlets/InjectServlet.class
 com/dextra/injectit/database/MockDatabase.class
+com/dextra/injectit/database/User.class
 com/dextra/injectit/booter/ContextListener.class
-=======
-com/dextra/injectit/database/MockDatabase.class
->>>>>>> a83373cb29646b4fd9576b44d0ae4a4128cd7637
 com/dextra/injectit/database/Database.class
-com/dextra/injectit/booter/ContextListener.class
-com/dextra/injectit/servlets/InjectServlet.class
-com/dextra/injectit/database/User.class

programming_language: Shell
filename: inputFiles.lst
change_type: ModificationType.MODIFY
diff: @@ -1,13 +1,5 @@
-<<<<<<< HEAD
-/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
-/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
-/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
-/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
-/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
-=======
-/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
-/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
-/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
-/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
-/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
->>>>>>> a83373cb29646b4fd9576b44d0ae4a4128cd7637
+/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
+/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
+/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
+/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
+/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java

programming_language: Shell
filename: access_log.2015-02-08
change_type: ModificationType.ADD
diff: @@ -0,0 +1,10 @@
+127.0.0.1 - - [08/Feb/2015:22:34:56 -0200] "GET / HTTP/1.1" 404 - http-bio-8080-exec-1 0
+127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt HTTP/1.1" 302 - http-bio-8080-exec-2 0
+127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/ HTTP/1.1" 200 582 http-bio-8080-exec-3 215
+127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/js/index.js HTTP/1.1" 200 597 http-bio-8080-exec-4 7
+127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/js/doT.js HTTP/1.1" 200 5163 http-bio-8080-exec-5 31
+127.0.0.1 - - [08/Feb/2015:22:35:06 -0200] "GET /injectIt/api/usuarios HTTP/1.1" 405 1065 http-bio-8080-exec-7 4
+127.0.0.1 - - [08/Feb/2015:22:35:10 -0200] "POST /injectIt/api/usuarios HTTP/1.1" 200 12 http-bio-8080-exec-8 58
+127.0.0.1 - - [08/Feb/2015:22:35:10 -0200] "GET /injectIt/templates/template.html HTTP/1.1" 200 296 http-bio-8080-exec-9 27
+127.0.0.1 - - [08/Feb/2015:22:35:14 -0200] "POST /injectIt/api/usuarios HTTP/1.1" 200 84 http-bio-8080-exec-10 10
+127.0.0.1 - - [08/Feb/2015:22:54:04 -0200] "GET /help/topic/com.vmware.ICbase/images/vmware_favicon.ico HTTP/1.1" 404 - http-bio-8080-exec-2 0

programming_language: Shell