CVE-2014-125067 (published 2023-01-08T10:15Z)

A vulnerability classified as critical was found in corincerami curiosity. Affected by this vulnerability is an unknown functionality of the file app/controllers/image_controller.rb. The manipulation of the argument sol leads to sql injection. The patch is named d64fddd74ca72714e73f4efe24259ca05c8190eb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217639.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/corincerami/curiosity
commit_details: repo_url: https://github.com/corincerami/curiosity
author: Chris C Cerami
author_date: 2014-12-07 13:00:33-05:00
msg: Sanitized form input to protect against SQL injection.
repository: repo_url: https://github.com/corincerami/curiosity
repo_name: corincerami/curiosity
description: Rails app to make available image data from NASA's Mars Curiosity Rover
repo_language: Ruby
owner: corincerami
file_changes: filename: .gitignore
change_type: ModificationType.MODIFY
diff: @@ -15,3 +15,4 @@
 /log/*.log
 /tmp
 .env
+images.rb

programming_language: Shell
filename: image_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -1,11 +1,10 @@
 class ImageController < ApplicationController
   def show
-    @images = Image.where(sol: params[:sol])
+    @images = Image.where(:sol => params[:sol])
   end
 
   def index
-    # find the martial solar date of the most recent image taken
-    # @most_recent = Image.all.sort_by { |hash| -hash[:sol].to_i }.first[:sol]
+    # find the martian solar date of the most recent image taken
     @image_count = Image.count
     @most_recent = Image.maximum(:sol)
   end

programming_language: Ruby
filename: show.html.erb
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 <div class='row'>
   <div class='small 6'>
     <p>
-      These photos were captured by Curiosity on sol <%= params[:sol] %> of its mission on Mars. They come from its eight cameras: the front hazard avoidance camera (FHAZ), read hazard avoidance camera (RHAZ), left and right navigation cameras (NAVCAM), chemistry camera (CHEMCAM), Mars descent imager (MARDI), Mars hand lens imager (MAHLI), and mast camera (Mastcam).
+      These photos were captured by Curiosity on sol <%=h params[:sol] %> of its mission on Mars. They come from its eight cameras: the front hazard avoidance camera (FHAZ), read hazard avoidance camera (RHAZ), left and right navigation cameras (NAVCAM), chemistry camera (CHEMCAM), Mars descent imager (MARDI), Mars hand lens imager (MAHLI), and mast camera (Mastcam).
     </p>
   </div>
 </div>

programming_language: PHP