SentinelDataHub/DataHubSystem

sql injection

Closed this issue · 3 comments

mkaesberger commented

There is a sql injection in core/src/main/java/fr/gael/dhus/database/dao/ProductDao.java:364: getProductByUuid does not verify the parameter uuid (eg /odata/v1/Products(''')). I think I've seen another unsafe query where the username could be used.

SentinelDataHub commented

Fixed in DHuS version 0.12.5-6-osf.

mkaesberger commented

Still not fixed in 0.12.5-6-osf.

  • 👍1
Rayne commented

The tag 0.12.5-6-osf is still vulnerable (0.12.5-6-osf/…/ProductDao.java). This isn't surprising as the method body wasn't touched for ten months.