CVE-2015-10020 (published 2023-01-14T21:15Z)

A vulnerability has been found in ssn2013 cis450Project and classified as critical. This vulnerability affects the function addUser of the file HeatMapServer/src/com/datformers/servlet/AddAppUser.java. The manipulation leads to sql injection. The name of the patch is 39b495011437a105c7670e17e071f99195b4922e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218380.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ssn2013/cis450Project
commit_details: repo_url: https://github.com/ssn2013/cis450Project
author: dashdeep13
author_date: 2015-04-29 18:16:24-04:00
msg: sql injection changes
repository: repo_url: https://github.com/ssn2013/cis450Project
repo_name: ssn2013/cis450Project
repo_language: Java
owner: ssn2013
file_changes: filename: OracleDBWrapper.java
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 package com.datformers.database;
 
 import java.sql.*;
+import java.util.ArrayList;
 import java.util.Enumeration;
 
 
@@ -46,6 +47,26 @@ public class OracleDBWrapper {
 		
 			return rs;
 	}
+	public ResultSet executeValidateQuery(String query,ArrayList<String> params) {
+		PreparedStatement  preparedStatement;
+
+		 ResultSet rs = null;
+		 
+		try {
+			preparedStatement=conn.prepareStatement(query) ;
+			for(int i=0;i<params.size();i++) {
+				preparedStatement.setString(i+1,params.get(i));	
+			}
+			
+			rs = preparedStatement.executeQuery();
+			
+		} catch (Exception e) {
+			// TODO Auto-generated catch block
+			e.printStackTrace();
+		}
+		
+			return rs;
+	}
 	public void closeConnection() {
 		try {
 			conn.close();

programming_language: Java
filename: AddAppUser.java
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,7 @@ import java.sql.DriverManager;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Statement;
+import java.util.ArrayList;
 
 import com.datformers.database.OracleDBWrapper;
 import com.datformers.utils.DatabaseUtil;
@@ -13,10 +14,12 @@ import com.datformers.utils.DatabaseUtil;
 
 public class AddAppUser {
 	String query = "";
+	ArrayList<String> params=null;
 	OracleDBWrapper wrapper;
 
-	public AddAppUser(String str){
+	public AddAppUser(String str,ArrayList<String> p){
 		query = str;
+		params=p;
 		wrapper = new OracleDBWrapper(DatabaseUtil.getURL(DatabaseUtil.IP), DatabaseUtil.UERNAME, DatabaseUtil.PASSWORD);
 	}
 	public ResultSet addUser(){
@@ -25,7 +28,7 @@ public class AddAppUser {
 		//String query1 = "Insert into APPUSER(USER_ID,EMAIL,PASSWORD,FIRST_NAME,LAST_NAME,IS_FACEBOOK_LOGIN)"
 		//		+ " values (usr_id.NEXTVAL,'aryaa@seas.upenn.edu','test','ARyaa','Gautam','Y')";
 		
-		ResultSet rs = wrapper.executeQuery(query);
+		ResultSet rs = wrapper.executeValidateQuery(query, params);
 		return rs;
 		
 		

programming_language: Java
filename: HeatMapServlet.java
change_type: ModificationType.MODIFY
diff: @@ -36,7 +36,7 @@ public class HeatMapServlet extends HttpServlet {
 					+ "where business.city='" + city 
 					+ "' and categories.category='"+category +"'"
 					+"order by c.check_in_info DESC";
-			System.out.println("QString: "+queryString);
+			
 			ResultSet set = dbWrapper.executeQuery(queryString);
 			if(set==null) {
 				return;

programming_language: Java
filename: LoginServlet.java
change_type: ModificationType.MODIFY
diff: @@ -5,6 +5,7 @@ import java.io.UnsupportedEncodingException;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.sql.ResultSet;
+import java.util.ArrayList;
 import java.util.Formatter;
 
 import javax.servlet.http.HttpServlet;
@@ -41,22 +42,24 @@ public class LoginServlet extends HttpServlet {
 				String isValidPwd = "";
 				response.setContentType("text/html");
 				PrintWriter out = response.getWriter();
-				System.out.println("user:pwd" + username + password);
+				
 				if (username.isEmpty() || password.isEmpty()) {
 					out.println("<html><head><body><p>A mandatory field is empty!<p></body></head>");
 					System.out.println("EMPTY");
 					return;
 				}
 				AddAppUser tmp = null;
-				String query = "Select password from APPUSER where email LIKE '"
-						+ username + "'";
-				System.out.println(query);
-				tmp = new AddAppUser(query);
+				String query = "Select password from APPUSER where email=?";
+//						+ username + "'";
+				
+				ArrayList<String> params=new ArrayList<String>();
+				params.add(username);
+				tmp = new AddAppUser(query,params);
 				ResultSet res = tmp.addUser();
 				
 				if (res.next()) {
 					isValidPwd = res.getString("password");
-					System.out.println(isValidPwd);
+					
 				}
 				
 				password=encryptPassword(password);
@@ -101,10 +104,12 @@ public class LoginServlet extends HttpServlet {
 					// System.out.println("<html><head><body><p>A mandatory field is empty!<p></body></head>");
 
 				} else {
-					String query = "SELECT count(*) as cnt FROM APPUSER WHERE email LIKE '"
-							+ email + "'";
+					String query = "SELECT count(*) as cnt FROM APPUSER WHERE email=?";
+//							+ email + "'";
 					// System.out.println("Signup query" + query);
-					AddAppUser add = new AddAppUser(query);
+					ArrayList<String> params=new ArrayList<String>();
+					params.add(email);
+					AddAppUser add = new AddAppUser(query,params);
 					ResultSet res = add.addUser();
 					int count = 0;
 					if (res.next()) {
@@ -112,16 +117,18 @@ public class LoginServlet extends HttpServlet {
 					}
 					
 					add.closeDb();
-					System.out.println("Signup query" + query);
+					
 					if (count > 0) {
 						// System.out.println("Already Registered");
 						out.println("<html><head><body><p>This email id is already registered!!</p></body></head>");
 					} else {
 						// System.out.println("Registering!");
+						params=new ArrayList<String>();
+						params.add(email);
 						String query1 = "Insert into APPUSER(USER_ID,EMAIL,PASSWORD,FIRST_NAME,LAST_NAME,IS_FACEBOOK_LOGIN)"
-								+ " values (usr_id.NEXTVAL,'"
-								+ email
-								+ "','"
+								+ " values (usr_id.NEXTVAL,?"
+//								+ email
+								+ ",'"
 								+ encrypt
 								+ "','"
 								+ first
@@ -130,7 +137,7 @@ public class LoginServlet extends HttpServlet {
 								+ "','"
 								+ isFbLogin + "')";
 						// System.out.println(query1);
-						AddAppUser tmp = new AddAppUser(query1);
+						AddAppUser tmp = new AddAppUser(query1,params);
 						tmp.addUser();
 						tmp.closeDb();
 						response.sendRedirect("main.html");

programming_language: Java