CVE-2022-0983 An SQL injection risk was identified in Badges code relating to configuring criteria

CVE-2022-0983 An SQL injection risk was identified in Badges code relating to configuring criteria

The risk was mitigated by restricting the Badges feature to users with the “Managers” and “Teachers” roles. A “Configure Criteria” form was created for teachers to enter criteria, and a “Configure Manager” form for managers to enter criteria. Both forms had a “Description” field in which teachers and managers would enter information about Badges that would be visible to all users.

An SQL injection risk was identified in the code for the “Configure Manager” form. A teacher would have to be logged in as a manager to execute an SQL injection.

Conclusion: Takeaways for developers

Developers should ensure that their web applications are secure by using proper input validation and malicious input mitigation within their code.

Internal Risk Analyses

An increase in student attrition was a risk that managers considered. After reviewing the findings of the Risk Analysis, they decided to mitigate the risk by restricting Badges to users with the “Managers” and “Teachers” roles. Additionally, a “Configure Criteria” form for teachers was created and a “Configure Manager” form for managers was created. Both forms allowed for administrators to enter information about criteria for Badges visible to all and included a “Description” field in which administrators could enter information about what would be visible to all users.

An SQL injection risk was identified in the code for the “Configure Manager” form. A teacher would have to be logged in as a manager to execute an SQL injection vulnerability.

Third-party code and libraries risk

The risk was mitigated by restricting the Badges feature to users with the “Managers” and “Teachers” roles. A “Configure Criteria” form was created for teachers to enter criteria, and a “Configure Manager” form for managers to enter criteria. Both forms had a “Description” field in which teachers and managers would enter information about Badges that would be visible to all users.

The third party library used is vulnerable to SQL injection attacks from untrusted input.

References

Subscribe to CVE.news
Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe