| タイトル | lock-upme OPMS latest SQL Injection |
|---|
| 説明 | A SQL Injection vulnerability was identified in multiple endpoints of the application due to improper handling of the `ids` parameter.
The affected code directly concatenates user-controlled input into SQL statements without proper validation or parameterization. An attacker may be able to manipulate the SQL query structure by supplying crafted values through the `ids` parameter.
Affected Components:
1. Message Deletion Interface
* Source: `controllers/messages/message.go:97`
* Sink: `models/messages/messages.go:118`
* Vulnerable Code:
```go
o.Raw("DELETE FROM "+TableName+" WHERE msgid IN("+ids+")")
```
* Issue: The `ids` parameter is directly concatenated into the `IN()` clause, leading to a potential SQL Injection vulnerability.
2. Project Version Deletion Interface
* Source: `controllers/projects/version.go:211`
* Sink: `models/projects/versions.go:183`
* Vulnerable Code:
```go
o.Raw("DELETE FROM "+TableName+" WHERE versionid IN("+ids+") AND userid=?", userid)
```
* Issue: The `ids` parameter is directly injected into the SQL statement without sanitization.
3. Project Document Deletion Interface
* Source: `controllers/projects/doc.go:214`
* Sink: `models/projects/docs.go:189`
* Vulnerable Code:
```go
o.Raw("DELETE FROM "+TableName+" WHERE docid IN("+ids+") AND userid=?", userid)
```
* Issue: User-controlled input is concatenated into the `IN()` clause, creating a SQL Injection risk.
4. Permission Deletion Interface
* Source: `controllers/groups/permission.go:153`
* Sink: `models/groups/permissions.go:138`
* Vulnerable Code:
```go
o.Raw("DELETE FROM "+TableName+" WHERE permissionid IN("+ids+")")
```
* Issue: The `ids` parameter is not validated before being incorporated into the SQL query.
5. Group Deletion Interface
* Source: `controllers/groups/group.go:127`
* Sink: `models/groups/groups.go:107`
* Vulnerable Code:
```go
o.Raw("DELETE FROM "+TableName+" WHERE groupid IN("+ids+")")
```
* Issue: Direct string concatenation of attacker-controlled input may allow SQL Injection.
Impact:
An authenticated attacker with access to the affected endpoints may be able to manipulate SQL queries, potentially resulting in unauthorized data access, data modification, data deletion, or further compromise of the application's database depending on the underlying database configuration and permissions.
Root Cause:
The application constructs SQL statements through string concatenation instead of using parameterized queries or prepared statements. User-supplied values contained in the `ids` parameter are inserted directly into the SQL `IN()` clause without proper validation.
|
|---|
| ユーザー | N1y1 (UID 99204) |
|---|
| 送信 | 2026年06月23日 07:21 (2 月 ago) |
|---|
| モデレーション | 2026年08月08日 20:42 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 387208 [lock-upme OPMS 迄 831440f37a92c1568f2e071d5233bc873a9d8b09 IN Clause message.go ids SQLインジェクション] |
|---|
| ポイント | 17 |
|---|