PostgreSQL database not accepting edits

Open
#235 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
postgresql
Domain
api, databases, security

Research direction

Start by reproducing the request against /workshop/api/shop/apply_coupon and inspect how the applied_coupon table is handled in the crAPI config file. Check the relevant logs for the 500 response and determine whether database edits are supported; done means the issue documents the required configuration or expected error.

Written by the indexing model from the issue text.

Description

Hi,
In Challenge 13, I have found the coupon_code parameter in the /workshop/api/shop/apply_coupon to be injectable.
I also found the applied_coupon table in the PostgreSQL database.

The endpoint accepts the following injection and returns the database version:
"coupon_code":"TRAC075'; SELECT version() --+"

But it refuses the following and returns a 500 error:
"coupon_code":"TRAC075'; DELETE FROM applied_coupon WHERE coupon_code=TRAC075 --+"

Is there anything that needs to be changed in the crAPI config file to allow user edits to be made to the database? I noticed there are restrictions for shell injection.

Thanks,
Edw.

Dominant language
Java
Stars
1.6k
Forks
645
Avg merge
37m
Merged PRs (30d)
1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OWASP/crAPI

All issues in OWASP/crAPI

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.