| 제목 | lock-upme OPMS latest SQL Injection |
|---|
| 설명 | A SQL Injection vulnerability was identified in multiple endpoints of the application due to improper handling of the `ids` parameter.
The affected code directly concatenates user-controlled input into SQL statements without proper validation or parameterization. An attacker may be able to manipulate the SQL query structure by supplying crafted values through the `ids` parameter.
Affected Components:
1. Message Deletion Interface
* Source: `controllers/messages/message.go:97`
* Sink: `models/messages/messages.go:118`
* Vulnerable Code:
```go
o.Raw("DELETE FROM "+TableName+" WHERE msgid IN("+ids+")")
```
* Issue: The `ids` parameter is directly concatenated into the `IN()` clause, leading to a potential SQL Injection vulnerability.
2. Project Version Deletion Interface
* Source: `controllers/projects/version.go:211`
* Sink: `models/projects/versions.go:183`
* Vulnerable Code:
```go
o.Raw("DELETE FROM "+TableName+" WHERE versionid IN("+ids+") AND userid=?", userid)
```
* Issue: The `ids` parameter is directly injected into the SQL statement without sanitization.
3. Project Document Deletion Interface
* Source: `controllers/projects/doc.go:214`
* Sink: `models/projects/docs.go:189`
* Vulnerable Code:
```go
o.Raw("DELETE FROM "+TableName+" WHERE docid IN("+ids+") AND userid=?", userid)
```
* Issue: User-controlled input is concatenated into the `IN()` clause, creating a SQL Injection risk.
4. Permission Deletion Interface
* Source: `controllers/groups/permission.go:153`
* Sink: `models/groups/permissions.go:138`
* Vulnerable Code:
```go
o.Raw("DELETE FROM "+TableName+" WHERE permissionid IN("+ids+")")
```
* Issue: The `ids` parameter is not validated before being incorporated into the SQL query.
5. Group Deletion Interface
* Source: `controllers/groups/group.go:127`
* Sink: `models/groups/groups.go:107`
* Vulnerable Code:
```go
o.Raw("DELETE FROM "+TableName+" WHERE groupid IN("+ids+")")
```
* Issue: Direct string concatenation of attacker-controlled input may allow SQL Injection.
Impact:
An authenticated attacker with access to the affected endpoints may be able to manipulate SQL queries, potentially resulting in unauthorized data access, data modification, data deletion, or further compromise of the application's database depending on the underlying database configuration and permissions.
Root Cause:
The application constructs SQL statements through string concatenation instead of using parameterized queries or prepared statements. User-supplied values contained in the `ids` parameter are inserted directly into the SQL `IN()` clause without proper validation.
|
|---|
| 사용자 | N1y1 (UID 99204) |
|---|
| 제출 | 2026. 06. 23. AM 07:21 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 08. PM 08:42 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 387208 [lock-upme OPMS 까지 831440f37a92c1568f2e071d5233bc873a9d8b09 IN Clause message.go ids SQL 주입] |
|---|
| 포인트들 | 17 |
|---|