CVE-2022-0983 An SQL injection risk was identified in Badges code relating to configuring criteria
The risk was mitigated by restricting the Badges feature to users with the “Managers” and “Teachers” roles. A “Configure Criteria” form was created for teachers to enter criteria, and a “Configure Manager” form for managers to enter criteria. Both forms had a “Description” field in which teachers and managers would enter information about Badges that would be visible to all users.
An SQL injection risk was identified in the code for the “Configure Manager” form. A teacher would have to be logged in as a manager to execute an SQL injection.
Conclusion: Takeaways for developers
Developers should ensure that their web applications are secure by using proper input validation and malicious input mitigation within their code.
Internal Risk Analyses
An increase in student attrition was a risk that managers considered. After reviewing the findings of the Risk Analysis, they decided to mitigate the risk by restricting Badges to users with the “Managers” and “Teachers” roles. Additionally, a “Configure Criteria” form for teachers was created and a “Configure Manager” form for managers was created. Both forms allowed for administrators to enter information about criteria for Badges visible to all and included a “Description” field in which administrators could enter information about what would be visible to all users.
An SQL injection risk was identified in the code for the “Configure Manager” form. A teacher would have to be logged in as a manager to execute an SQL injection vulnerability.
Third-party code and libraries risk
The risk was mitigated by restricting the Badges feature to users with the “Managers” and “Teachers” roles. A “Configure Criteria” form was created for teachers to enter criteria, and a “Configure Manager” form for managers to enter criteria. Both forms had a “Description” field in which teachers and managers would enter information about Badges that would be visible to all users.
The third party library used is vulnerable to SQL injection attacks from untrusted input.
Timeline
Published on: 03/25/2022 19:15:00 UTC
Last modified on: 03/30/2022 19:16:00 UTC