CVE-2014-125065 (published 2023-01-07T20:15Z)

A vulnerability, which was classified as critical, was found in john5223 bottle-auth. Affected is an unknown function. The manipulation leads to sql injection. The name of the patch is 99cfbcc0c1429096e3479744223ffb4fda276875. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217632.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/john5223/bottle-auth
commit_details: repo_url: https://github.com/john5223/bottle-auth
author: john5223
author_date: 2014-12-15 10:45:53-06:00
msg: no more sql injection and better tests
repository: repo_url: https://github.com/john5223/bottle-auth
repo_name: john5223/bottle-auth
repo_language: Python
owner: john5223
file_changes: filename: group_controller.py
change_type: ModificationType.MODIFY
diff: @@ -32,9 +32,17 @@ def get_group(db, group_name):
     if not rows:
         return error(404, {'error': 'Not a valid group'})
 
-    userids = ["'%s'" % x['userid'] for x in rows if x['userid']]
-    users = db.query("SELECT * FROM users WHERE userid IN (%s) " % ','.join(userids))
-    ret = {group_name: list(users) }
+    userids = [x['userid'] for x in rows if x['userid']]
+    if not userids:
+        return {group_name: []}
+
+    params = {}
+    for i, userid in enumerate(userids,1):
+        params['userid_' + str(i)] = str(userid)
+    where_clause = 'userid IN(:' + ",:".join(params.keys()) + ')' # b/c sqlalchemy can't use a list!?
+    q = "SELECT * FROM users WHERE " + where_clause
+    users = db.executable.execute(q, params).fetchall()
+    ret = {group_name: [dict(x.items()) for x in users] }
     return ret
 
 

programming_language: Python
filename: user_controller.py
change_type: ModificationType.MODIFY
diff: @@ -38,7 +38,7 @@ def delete_user(db, userid):
 
 
 @route('/users/<userid>', method=['POST', 'PUT'])
-def create__update_user(db, userid):
+def create_update_user(db, userid):
     data = request.json
     data_keys = data.keys()
     required_fields = ['first_name', 'last_name', 'userid', 'groups']
@@ -71,10 +71,13 @@ def create__update_user(db, userid):
 
     if request.method == 'PUT':
         #get rid of any old groups for this user
-        q = '''DELETE FROM groups 
-                WHERE userid='{userid}'
-                            AND name not in ({group_names})
-              '''.format(userid=userid, group_names=','.join(["'%s'" % x for x in groups]))
-        db.query(q)
+        params = {}
+        for counter, group in enumerate(groups,1):
+            params["group_name" + str(counter)] = group
+            counter += 1
+        where_clause = 'name NOT IN(:' + ",:".join(params.keys()) + ')' # b/c sqlalchemy can't use a list!?
+        params['userid'] = userid
+        q = '''DELETE FROM groups WHERE userid=:userid AND ''' + where_clause
+        db.executable.execute(q, params)
 
     return {'status': 200, 'user': get_user(db, userid)}

programming_language: Python
filename: test_integration.py
change_type: ModificationType.RENAME
diff: @@ -8,7 +8,7 @@ from auth import simpleauth
 
 app = TestApp(simpleauth.app)
 
-def test_users():
+def test_user_integration():
     headers = [('Content-type', 'application/json')]
     payload = { "first_name": "Joe",
 	    "last_name": "Smith",
@@ -55,7 +55,7 @@ def test_users():
     assert delete_user.status == '200 OK'
 
 
-def test_groups():
+def test_groups_integration():
     headers = [('Content-type', 'application/json')]
     payload = { "first_name": "Joe",
         "last_name": "Smith",

programming_language: Python
filename: test_units.py
change_type: ModificationType.ADD
diff: @@ -0,0 +1,35 @@
+import logging
+logging.basicConfig(level=logging.DEBUG)
+import json
+
+from webtest import TestApp #Docs: http://webtest.pythonpaste.org/en/latest/
+from auth import simpleauth
+
+
+app = TestApp(simpleauth.app)
+
+def test_sql_injection():
+	
+	pass
+
+
+def test_create_user():
+	pass
+
+def test_update_user():
+	pass
+
+def test_delete_user():
+	pass
+
+
+
+def test_create_group():
+	pass
+
+def test_update_group():
+	pass
+
+def test_delete_group():
+	pass
+

programming_language: Python