CVE-2014-125037 (published 2023-01-02T18:15Z)

A vulnerability, which was classified as critical, was found in License to Kill. This affects an unknown part of the file models/injury.rb. The manipulation of the argument name leads to sql injection. The patch is named cd11cf174f361c98e9b1b4c281aa7b77f46b5078. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217191.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/elizabrock/license-to-kill
commit_details: repo_url: https://github.com/elizabrock/license-to-kill
author: Eliza Brock
author_date: 2014-05-01 09:22:12-05:00
msg: Fix the SQL injection! STRING INTERPOLATION - NEVER AGAIN. NEVER!
repository: repo_url: https://github.com/elizabrock/license-to-kill
repo_name: elizabrock/license-to-kill
description: NSS Cohort Tangerine In-Class Database Project
repo_language: Ruby
owner: elizabrock
file_changes: filename: database.rb
change_type: ModificationType.MODIFY
diff: @@ -13,8 +13,8 @@ class Database < SQLite3::Database
     self.execute("CREATE TABLE injuries (id INTEGER PRIMARY KEY AUTOINCREMENT, name varchar(50))")
   end
 
-  def execute(statement)
+  def execute(statement, bind_vars = [])
     Environment.logger.info("Executing: " + statement)
-    super(statement)
+    super(statement, bind_vars)
   end
 end

programming_language: Ruby
filename: injury.rb
change_type: ModificationType.MODIFY
diff: @@ -19,8 +19,8 @@ class Injury
   end
 
   def self.find_by_name(name)
-    statement = "Select * from injuries where name = \"#{name}\";"
-    execute_and_instantiate(statement)[0]
+    statement = "Select * from injuries where name = ?;"
+    execute_and_instantiate(statement, name)[0]
   end
 
   def self.last
@@ -33,16 +33,16 @@ class Injury
       @errors << "#{self.name} already exists."
       false
     else
-      statement = "Insert into injuries (name) values ('#{name}');"
-      Environment.database_connection.execute(statement)
+      statement = "Insert into injuries (name) values (?);"
+      Environment.database_connection.execute(statement, name)
       true
     end
   end
 
   private
 
-  def self.execute_and_instantiate(statement)
-    rows = Environment.database_connection.execute(statement)
+  def self.execute_and_instantiate(statement, bind_vars = [])
+    rows = Environment.database_connection.execute(statement, bind_vars)
     results = []
     rows.each do |row|
       results << Injury.new(row["name"])

programming_language: Ruby
filename: injury_integration_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -57,12 +57,15 @@ describe "Adding an injury" do
     context "without alphabet characters" do
       let(:output){ run_ltk_with_input("2", "4*25") }
       it "should not save the injury" do
+        pending
         Injury.count.should == 1
       end
       it "should print an error message" do
+        pending
         output.should include("'4*25' is not a valid injury name, as it does not include any letters'")
       end
       it "should let them try again" do
+        pending
         menu_text = "What is the injury you want to add?"
         output.should include_in_order(menu_text, "not a valid", menu_text)
       end

programming_language: Ruby