Mutliple SQL Injection Security Vulnerabilities

[tch1bo]

Hello,

I noticed several SQL Injections in Server/database.py.

For example:

VideoHub/Server/database.py

Line 28 in dcc3308

done1 = self.cur.execute("SELECT password FROM users WHERE username=\"{}\"".format(username))

The issue here is that the unsanitized username is used to build an SQL query, which then gets executed. This allows attackers to own the database (see the OWASP page above for a complete list of risks).

To fix the issue i would suggest using prepared statements.
For example,
done1 = self.cur.execute("SELECT password FROM users WHERE username=\"{}\"".format(username))

can be rewritten to:

done1 = self.cur.execute("SELECT password FROM users WHERE username='%s'", username)

(all the other similar lines should be changed accordingly).

I found the bug while testing DeepCode’s AI Code Review. The tool can help you automate the process of finding such (and many other types of) bugs. You can sign-up your repo (free for Open Source) to receive notifications whenever new bugs are detected. You can give it a try here.

Any feedback is more than welcome at [email protected].
Cheers, Victor.