OWASP / OWASP/crAPI

PostgreSQL database not accepting edits

Open
#235 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
1.6k
Forks
645
Avg merge
37m
Merged PRs (30d)
1

Description

Hi,
In Challenge 13, I have found the coupon_code parameter in the /workshop/api/shop/apply_coupon to be injectable.
I also found the applied_coupon table in the PostgreSQL database.

The endpoint accepts the following injection and returns the database version:
"coupon_code":"TRAC075'; SELECT version() --+"

But it refuses the following and returns a 500 error:
"coupon_code":"TRAC075'; DELETE FROM applied_coupon WHERE coupon_code=TRAC075 --+"

Is there anything that needs to be changed in the crAPI config file to allow user edits to be made to the database? I noticed there are restrictions for shell injection.

Thanks,
Edw.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the request against /workshop/api/shop/apply_coupon and inspect how the applied_coupon table is handled in the crAPI config file. Check the relevant logs for the 500 response and determine whether database edits are supported; done means the issue documents the required configuration or expected error.

Written by the indexing model from the issue text.

Assessment

Tech stack
postgresql
Domain
api, databases, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.