CVE-2015-5659 (published 2015-10-11T01:59Z)

SQL injection vulnerability in Network Applied Communication Laboratory Pref Shimane CMS 2.x before 2.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/NaCl-Ltd/pref-shimane-cms
commit_details: repo_url: https://github.com/NaCl-Ltd/pref-shimane-cms
author: Yusuke Anno
author_date: 2015-10-07 13:13:11+09:00
msg: SQLインジェクションにより、情報を不正取得できてしまう不具合を修正
repository: repo_url: https://github.com/NaCl-Ltd/pref-shimane-cms
repo_name: NaCl-Ltd/pref-shimane-cms
repo_language: Ruby
owner: NaCl-Ltd
file_changes: filename: CHANGELOG.md
change_type: ModificationType.ADD
diff: @@ -0,0 +1,11 @@
+# Changelog
+
+## Version 2.0.1 (2015/10/7)
+
+* Bugfix
+
+  * SQLインジェクションにより、情報を不正取得できてしまう不具合を修正
+
+## Version 2.0.0 (2014/9/6)
+
+* 初期リリース
\ No newline at end of file

programming_language: Markdown
filename: pages_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -254,7 +254,6 @@ module Concerns::Susanoo::PagesController
           super
         end
 
-
         #
         #=== 検索を実施する
         #
@@ -278,7 +277,43 @@ module Concerns::Susanoo::PagesController
             false
           end
         end
+
+        #
+        #=== ソート順を返す
+        #
+        def order_by
+          order_option = ''
+          if valid_order_params?
+            direction = self.order_direction || 'ASC'
+            order_option = "#{self.order_column} #{direction}"
+          end
+          order_option.present? ? order_option : @@default_order
+        end
+
+        #
+        #=== ソートパラメータを検証する
+        #
+        def valid_order_params?
+          if self.order_column.blank?
+            return false
+          end
+
+          permit_column_params = ['pages.name', 'page_contents.last_modified']
+          permit_dir_params = ['ASC', 'DESC']
+
+          unless permit_column_params.include?(self.order_column)
+            return false
+          end
+
+          if self.order_direction.present? &&
+            !permit_dir_params.include?(self.order_direction.upcase)
+            return false
+          end
+
+          return true
+        end
       end
+
   end
 end
 

programming_language: Ruby
filename: version.rb
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 module PrefShimaneCms
   class Application
-    VERSION = '2.0.0'
+    VERSION = '2.0.1'
   end
 end

programming_language: Ruby
repo_url: https://github.com/NaCl-Ltd/pref-shimane-cms
commit_details: repo_url: https://github.com/NaCl-Ltd/pref-shimane-cms
author: Yusuke Anno
author_date: 2015-10-07 13:31:38+09:00
msg: 検索フォームクラスごとにソート順を作成するよう修正
repository: repo_url: https://github.com/NaCl-Ltd/pref-shimane-cms
repo_name: NaCl-Ltd/pref-shimane-cms
repo_language: Ruby
owner: NaCl-Ltd
file_changes: filename: search_form.rb
change_type: ModificationType.MODIFY
diff: @@ -89,13 +89,9 @@ module Susanoo
     #
     #=== ソート順を返す
     #
+    # 子クラスでオーバーライドすること
+    #
     def order_by
-      order_option = ''
-      if self.order_column
-        direction = self.order_direction || 'ASC'
-        order_option = "#{self.order_column} #{direction}"
-      end
-      order_option.present? ? order_option : @@default_order
     end
 
     private

programming_language: Ruby