CVE-2016-15021 (published 2023-01-17T16:15Z)

A vulnerability was found in nickzren alsdb. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. Upgrading to version v2 is able to address this issue. The identifier of the patch is cbc79a68145e845f951113d184b4de207c341599. It is recommended to upgrade the affected component. The identifier VDB-218429 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/nickzren/alsdb
commit_details: repo_url: https://github.com/nickzren/alsdb
author: Nick Ren
author_date: 2016-10-19 15:29:48-04:00
msg: fixed sql injection vulnerability
repository: repo_url: https://github.com/nickzren/alsdb
repo_name: nickzren/alsdb
description: ALS Data Browser
repo_language: JavaScript
owner: nickzren
file_changes: filename: Input.java
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,6 @@
 package model;
 
+import java.sql.PreparedStatement;
 import object.Region;
 import util.DBManager;
 import util.FormatManager;
@@ -56,11 +57,11 @@ public class Input {
     }
 
     private static void initRegionListByGeneName(String geneName) throws Exception {
-        String sql = "SELECT * "
-                + "FROM gene_region "
-                + "WHERE gene_name='" + geneName + "'";
+        String sql = "SELECT * FROM gene_region WHERE gene_name=?";
 
-        ResultSet rset = DBManager.executeQuery(sql);
+        PreparedStatement stmt = DBManager.prepareStatement(sql);
+        stmt.setString(1, geneName);
+        ResultSet rset = stmt.executeQuery();
 
         if (rset.next()) {
             query = rset.getString("gene_name");
@@ -73,11 +74,11 @@ public class Input {
     }
 
     private static void initRvisByGene(String geneName) throws Exception {
-        String sql = "SELECT * "
-                + "FROM rvis "
-                + "WHERE gene_name='" + geneName + "'";
+        String sql = "SELECT * FROM rvis WHERE gene_name=?";
 
-        ResultSet rset = DBManager.executeQuery(sql);
+        PreparedStatement stmt = DBManager.prepareStatement(sql);
+        stmt.setString(1, geneName);
+        ResultSet rset = stmt.executeQuery();
 
         if (rset.next()) {
             float f = FormatManager.getFloat(rset.getObject("rvis_percent"));

programming_language: Java
filename: Output.java
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,6 @@
 package model;
 
+import java.sql.PreparedStatement;
 import object.Region;
 import object.Variant;
 import util.DBManager;
@@ -38,12 +39,14 @@ public class Output {
 
         String sql = "SELECT * "
                 + "FROM variant_v2 "
-                + "WHERE chr='" + tmp[0] + "' "
-                + "AND pos=" + tmp[1] + " "
-                + "AND ref='" + tmp[2] + "' "
-                + "AND allele='" + tmp[3] + "'";
-
-        ResultSet rset = DBManager.executeQuery(sql);
+                + "WHERE chr= ? AND pos= ? AND ref= ? AND allele= ?";
+
+        PreparedStatement stmt = DBManager.prepareStatement(sql);
+        stmt.setString(1, tmp[0]);
+        stmt.setInt(2, Integer.valueOf(tmp[1]));
+        stmt.setString(3, tmp[2]);
+        stmt.setString(4, tmp[3]);
+        ResultSet rset = stmt.executeQuery();
 
         if (rset.next()) {
             variant = new Variant(rset);

programming_language: Java
filename: Variant.java
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,6 @@
 package object;
 
+import java.sql.PreparedStatement;
 import util.DBManager;
 import util.FormatManager;
 import java.sql.ResultSet;
@@ -131,12 +132,14 @@ public class Variant {
     public void initAnnotationMap() throws Exception {
         String sql = "SELECT * "
                 + "FROM annotation_v2 "
-                + "WHERE variant_id = " + id + " "
+                + "WHERE variant_id = ? "
                 + "ORDER BY igm_rank,"
                 // when igm_rank is the same, the data sort by "Canonical" = "YES"
                 + "case when canonical is null then 1 else 0 end,canonical;";
 
-        ResultSet rset = DBManager.executeQuery(sql);
+        PreparedStatement stmt = DBManager.prepareStatement(sql);
+        stmt.setInt(1, id);
+        ResultSet rset = stmt.executeQuery();
 
         while (rset.next()) {
             Annotation anno = new Annotation(rset);

programming_language: Java
filename: DBManager.java
change_type: ModificationType.MODIFY
diff: @@ -86,4 +86,8 @@ public class DBManager {
     public static ResultSet executeQuery(String sqlQuery) throws SQLException {
         return statement.executeQuery(sqlQuery);
     }
+    
+    public static PreparedStatement prepareStatement(String sqlQuery) throws SQLException{
+        return connection.prepareStatement(sqlQuery);
+    }
 }

programming_language: Java