CVE-2021-4290 (published 2022-12-27T23:15Z)

A vulnerability was found in DHBW Fallstudie. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file app/config/passport.js of the component Login. The manipulation of the argument id/email leads to sql injection. The name of the patch is 5c13c6a972ef4c07c5f35b417916e0598af9e123. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216907.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/maboehm/fallstudie
commit_details: repo_url: https://github.com/maboehm/fallstudie
author: Nymokrit
author_date: 2021-01-28 10:30:01+01:00
msg: Update passport.js

FIXES: SQLInjection Vulnerability in Login
repository: repo_url: https://github.com/maboehm/fallstudie
repo_name: maboehm/fallstudie
description: DHBW Fallstudie
repo_language: JavaScript
owner: maboehm
file_changes: filename: passport.js
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,7 @@ module.exports = function (passport) {
 
     // used to deserialize the user
     passport.deserializeUser(function (id, done) {
-        connection.query("select * from users where id = " + id, function (err, rows) {
+        connection.query("select * from users where id = ?", [id], function (err, rows) {
             done(err, rows[0]);
         });
     });
@@ -46,7 +46,7 @@ module.exports = function (passport) {
         function (req, email, password, done) {
             // find a user whose email is the same as the forms email
             // we are checking to see if the user trying to login already exists
-            connection.query("select * from users where email = '" + email + "'", function (err, rows) {
+            connection.query("select * from users where email = ?" + [email], function (err, rows) {
                 if (err) {return done(err);}
                 if (rows.length) {
                     req.signUpMessage = 'Diese e-Mail ist bei uns bereits registriert';
@@ -84,7 +84,7 @@ module.exports = function (passport) {
             passReqToCallback: true // allows us to pass back the entire request to the callback
         },
         function (req, email, password, done) { // callback with email and password from our form
-            connection.query("SELECT * FROM `users` WHERE `email` = '" + email + "'", function (err, rows) {
+            connection.query("SELECT * FROM `users` WHERE `email` = ?", [email], function (err, rows) {
                 if (err) {return done(err);}
 
                 if (!rows.length) {

programming_language: JavaScript