CVE-2015-10014 (published 2023-01-05T14:15Z)

A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identifier of the patch is 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f. It is recommended to apply a patch to fix this issue. The identifier VDB-217485 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/arekk/uke
commit_details: repo_url: https://github.com/arekk/uke
author: Arek K
author_date: 2015-11-17 14:30:39+01:00
msg: SQL injection possibility
repository: repo_url: https://github.com/arekk/uke
repo_name: arekk/uke
description: Baza pozwoleń UKE
repo_language: Ruby
owner: arekk
file_changes: filename: finder.rb
change_type: ModificationType.MODIFY
diff: @@ -49,12 +49,12 @@ class Uke::Finder
     SQL
     
     sql.gsub!(':uke_import_id', @active_import.id.to_s)
-    sql.gsub!(':lat_ne', conn.quote_string(bounds_ne['lat'].to_s))
-    sql.gsub!(':lat_sw', conn.quote_string(bounds_sw['lat'].to_s))
-    sql.gsub!(':lon_ne', conn.quote_string(bounds_ne['lng'].to_s))
-    sql.gsub!(':lon_sw', conn.quote_string(bounds_sw['lng'].to_s))
-    sql.gsub!(':lat', conn.quote_string(@location.latitude.to_s))
-    sql.gsub!(':lon', conn.quote_string(@location.longitude.to_s))
+    sql.gsub!(':lat_ne', conn.quote(bounds_ne['lat'].to_s))
+    sql.gsub!(':lat_sw', conn.quote(bounds_sw['lat'].to_s))
+    sql.gsub!(':lon_ne', conn.quote(bounds_ne['lng'].to_s))
+    sql.gsub!(':lon_sw', conn.quote(bounds_sw['lng'].to_s))
+    sql.gsub!(':lat', conn.quote(@location.latitude.to_s))
+    sql.gsub!(':lon', conn.quote(@location.longitude.to_s))
     
     result_to_hash select_using_uke_stations_result(sql)
   end
@@ -77,12 +77,12 @@ class Uke::Finder
     SQL
 
     sql.gsub!(':uke_import_id', @active_import.id.to_s)
-    sql.gsub!(':lat_ne', conn.quote_string(bounds_ne['lat'].to_s))
-    sql.gsub!(':lat_sw', conn.quote_string(bounds_sw['lat'].to_s))
-    sql.gsub!(':lon_ne', conn.quote_string(bounds_ne['lng'].to_s))
-    sql.gsub!(':lon_sw', conn.quote_string(bounds_sw['lng'].to_s))
-    sql.gsub!(':lat', conn.quote_string(@location.latitude.to_s))
-    sql.gsub!(':lon', conn.quote_string(@location.longitude.to_s))
+    sql.gsub!(':lat_ne', conn.quote(bounds_ne['lat'].to_s))
+    sql.gsub!(':lat_sw', conn.quote(bounds_sw['lat'].to_s))
+    sql.gsub!(':lon_ne', conn.quote(bounds_ne['lng'].to_s))
+    sql.gsub!(':lon_sw', conn.quote(bounds_sw['lng'].to_s))
+    sql.gsub!(':lat', conn.quote(@location.latitude.to_s))
+    sql.gsub!(':lon', conn.quote(@location.longitude.to_s))
 
     result_to_hash select_using_uke_stations_result(sql)
   end
@@ -97,7 +97,7 @@ class Uke::Finder
           WHERE (f.mhz BETWEEN :mhz_start AND :mhz_end)
     SQL
 
-    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':mhz_start', conn.quote_string(first.to_s)).gsub(':mhz_end', conn.quote_string(last.to_s)))
+    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':mhz_start', conn.quote(first.to_s)).gsub(':mhz_end', conn.quote(last.to_s)))
   end
 
   def by_frq
@@ -110,7 +110,7 @@ class Uke::Finder
           WHERE f.mhz = :mhz
     SQL
 
-    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':mhz', conn.quote_string(Uke::Unifier::frq_string(@q).to_s)))
+    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':mhz', conn.quote(Uke::Unifier::frq_string(@q).to_s)))
   end
 
   def by_string
@@ -121,10 +121,10 @@ class Uke::Finder
           FROM uke_stations us
           JOIN uke_operators uo on (uo.id = us.uke_operator_id)
          WHERE us.uke_import_id = :uke_import_id
-           AND (us.location LIKE '%:like%' OR us.name LIKE '%:like%' OR uo.name LIKE '%:like%')
+           AND (us.location LIKE :like OR us.name LIKE :like OR uo.name LIKE :like)
     SQL
 
-    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':like', conn.quote_string(@q)))
+    result_to_hash select_using_uke_stations_sql(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':like', conn.quote('%'+@q.to_s+'%')))
   end
 
   def by_frq_order_by_distance
@@ -149,7 +149,7 @@ class Uke::Finder
         ORDER BY distance ASC
     SQL
 
-    result_to_hash(conn.select_all(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':lat', conn.quote_string(@location.latitude.to_s)).gsub(':lon', conn.quote_string(@location.longitude.to_s)).gsub(':mhz', conn.quote_string(Uke::Unifier::frq_string(@q).to_s))))
+    result_to_hash(conn.select_all(sql.gsub(':uke_import_id', @active_import.id.to_s).gsub(':lat', conn.quote(@location.latitude.to_s)).gsub(':lon', conn.quote(@location.longitude.to_s)).gsub(':mhz', conn.quote(Uke::Unifier::frq_string(@q).to_s))))
   end
 
   private

programming_language: Ruby