0036251: Security problem in Create Budget Reports in Excel report

Description

SQL injection security problem in Create Budget Reports in Excel report.

Problem is how ReportBudgetGenerateExcel.printPageDataExcel method creates the query. Parameters are appended to the query without being parsed to avoid SQL injection.

See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9437 [^]

Steps To Reproduce

Tags

No tags attached.

Attached Files

Relationships [ Relation Graph ] [ Dependency Graph ]

blocks

defect

0036239

closed

collazoandy4

Security problem in Create Budget Reports in Excel report

Notes
(0097404) hgbot (developer) 2017-06-15 09:15	Repository: erp/backports/3.0PR17Q2.1 Changeset: fc8d674b25c591ecba1803292c1a6f6bd80c2845 Author: Armaignac <collazoandy4 <at> gmail.com> Date: Wed Jun 14 11:47:03 2017 -0400 URL: http://code.openbravo.com/erp/backports/3.0PR17Q2.1/rev/fc8d674b25c591ecba1803292c1a6f6bd80c2845 [^] Fixes issue 36251: Security problem in Create Budget Reports in Excel report SQL injection security problem in Create Budget Reports in Excel report. A UUID filter was added to check the params cAccountId and inpcAcctSchemaId. --- M src/org/openbravo/erpCommon/ad_reports/ReportBudgetGenerateExcel.java ---

(0097409) aferraz (manager) 2017-06-15 10:08	Code review OK

Issue History
Date Modified	Username	Field	Change
2017-06-14 11:34	aferraz	Type	defect => backport
2017-06-14 11:34	aferraz	Target Version	=> 3.0PR17Q2.1
2017-06-15 09:15	hgbot	Checkin
2017-06-15 09:15	hgbot	Note Added: 0097404
2017-06-15 09:15	hgbot	Status	scheduled => resolved
2017-06-15 09:15	hgbot	Resolution	open => fixed
2017-06-15 09:15	hgbot	Fixed in SCM revision	=> http://code.openbravo.com/erp/backports/3.0PR17Q2.1/rev/fc8d674b25c591ecba1803292c1a6f6bd80c2845 [^]
2017-06-15 10:08	aferraz	Review Assigned To	=> aferraz
2017-06-15 10:08	aferraz	Note Added: 0097409
2017-06-15 10:08	aferraz	Status	resolved => closed
2017-06-15 10:08	aferraz	Fixed in Version	=> 3.0PR17Q2.1