CVE-2014-125073 (published 2023-01-10T16:15Z)

A vulnerability was found in mapoor voteapp. It has been rated as critical. Affected by this issue is the function create_poll/do_poll/show_poll/show_refresh of the file app.py. The manipulation leads to sql injection. The patch is identified as b290c21a0d8bcdbd55db860afd3cadec97388e72. It is recommended to apply a patch to fix this issue. VDB-217790 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/mapoor/voteapp
commit_details: repo_url: https://github.com/mapoor/voteapp
author: mapoor
author_date: 2014-12-30 18:54:14+08:00
msg: prevent sql injection
repository: repo_url: https://github.com/mapoor/voteapp
repo_name: mapoor/voteapp
repo_language: JavaScript
owner: mapoor
file_changes: filename: app.py
change_type: ModificationType.MODIFY
diff: @@ -36,17 +36,15 @@ def create_poll():
 	try:
 		cursor = conn.cursor()  
 		uid = request.remote_addr
-		import pdb
-		pdb.set_trace()
 		vid = str(int(time.time()*100))
 		title, optn, l_dsc = parse_req()
 		optdsc = '|'.join(l_dsc)
 		optnum = '|'.join(['0']*optn)
 		sql = "insert into t_vote_info(FUid, FVoteId, FTitle, FOptionNum, \
 				FOptionDesc, FOptionVoteNum, FState, FCreateTime, FEndTime) \
-				values(\"%s\",\"%s\",\"%s\",%d,\"%s\",\"%s\",0,now(),now()+interval 1 day);" 
+				values(%s,%s,%s,%s,%s,%s,0,now(),now()+interval 1 day);" 
 		param = (uid, vid, title, optn, optdsc, optnum) 
-		res = cursor.execute(sql%param)
+		res = cursor.execute(sql, param)
 		conn.commit()
 		cursor.close()
 	except Exception,e:
@@ -58,8 +56,8 @@ def do_poll():
 	if "p_id" in request.args:
 		p_id = request.args['p_id']
 		cursor = conn.cursor()
-		sql_s = "select FTitle, FOptionDesc from t_vote_info where FVoteId=%s;"%p_id
-		res = cursor.execute(sql_s)
+		sql_s = "select FTitle, FOptionDesc from t_vote_info where FVoteId=%s;"
+		res = cursor.execute(sql_s, (p_id,))
 		r = cursor.fetchone()
 		cursor.close()
 		title = r[0]
@@ -75,13 +73,13 @@ def do_poll():
 	p_id = request.form['p_id']
 	try:
 		cursor = conn.cursor()
-		sql_s = "select FOptionVoteNum from t_vote_info where FVoteId=%s;"%p_id
-		res = cursor.execute(sql_s)
+		sql_s = "select FOptionVoteNum from t_vote_info where FVoteId=%s;"
+		res = cursor.execute(sql_s, (p_id,))
 		opt_pre = cursor.fetchone()[0].split('|')
 		opt_pre[o_id] = str(int(opt_pre[o_id])+1)
 		opt_new = '|'.join(opt_pre)
-		sql_u = "update t_vote_info set FOptionVoteNum=\"%s\" where FVoteId=\"%s\";"%(opt_new,p_id)
-		res = cursor.execute(sql_u)
+		sql_u = "update t_vote_info set FOptionVoteNum=%s where FVoteId=%s;"
+		res = cursor.execute(sql_u, (opt_new,p_id))
 		conn.commit()
 		cursor.close()
 	except Exception,e:
@@ -98,8 +96,8 @@ def show_poll():
 	rows = []
 	try:
 		cursor = conn.cursor()
-		sql_s = "select FTitle,FOptionDesc,FOptionVoteNum,FState,FEndTime from t_vote_info where FVoteId=%s;"%p_id
-		res = cursor.execute(sql_s)
+		sql_s = "select FTitle,FOptionDesc,FOptionVoteNum,FState,FEndTime from t_vote_info where FVoteId=%s;"
+		res = cursor.execute(sql_s, (p_id,))
 		r = cursor.fetchone()
 		cursor.close()
 		title = r[0]
@@ -121,8 +119,8 @@ def show_refresh():
 	rows = []
 	try:
 		cursor = conn.cursor()
-		sql_s = "select FTitle,FOptionDesc,FOptionVoteNum,FState,FEndTime from t_vote_info where FVoteId=%s;"%p_id
-		res = cursor.execute(sql_s)
+		sql_s = "select FTitle,FOptionDesc,FOptionVoteNum,FState,FEndTime from t_vote_info where FVoteId=%s;"
+		res = cursor.execute(sql_s, (p_id,))
 		r = cursor.fetchone()
 		cursor.close()
 		title = r[0]

programming_language: Python
filename: show.html
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,7 @@ $(document).ready(function(){
         {label: "{{ item[0] }}", value: {{ item[1] }}, color:"{{ item[2] }}"},
     {% endfor %}
     ];
-    var myPieChart = new Chart(ctx).Pie(data,{animationSteps: 60});
+    var pie_chart = new Chart(ctx).Pie(data,{animationSteps: 60});
     
     function diff_rows(old_, new_){
         n_o = old_.length;
@@ -45,7 +45,7 @@ $(document).ready(function(){
 
     timeout = [3,4,6,9,14,22,35,56,90,145];
     idx_timeout = 0;
-    function refresh(myChart){
+    function refresh(){
         var p_id = location.search.substring(1).split('=')[1];
         var p_ajax = {
             type: "POST",
@@ -57,11 +57,12 @@ $(document).ready(function(){
                 rows = d.rows;
                 if (diff_rows(data, rows) == 1){
                     data = rows;
-                    myChart.destroy();
-                    myPieChart = new Chart(ctx).Pie(data,{animation: false});
+                    pie_chart.destroy();
+                    pie_chart = new Chart(ctx).Pie(data,{animation: false});
                     this.ret = 1;
                 }
-                this.ret = 0;
+                else
+                    this.ret = 0;
             },
             error: function(e,b,c){
                 alert("ajax error function.");

programming_language: HTML