-
Type:
Enhancement
-
Status:
Closed
-
Priority:
Medium
-
Resolution:
Done
-
Affects Version/s:
None
-
Fix Version/s:
None
-
-
-
Module:
BenAdmin
- Security
-
-
Item State:
Production Complete
- Closed
We need to verify OR condition for SQL injection. Scenario which was tried to save is as mentioned below-
asdf' OR '1'='1
We have verified OR with single quote and at least one space before and after OR.
{"report":{"apdex":0.5,"isInitial":true,"journeyId":"f8cc1091-4218-410b-9cfc-76e565c9f7ba","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":1469.6000000238419,"redirectCount":0,"resourceLoadedEnd":2266.100000023842,"resourceLoadedStart":244.10000002384186,"resourceTiming":[{"duration":386.7999999523163,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":244.10000002384186,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":244.10000002384186,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":630.8999999761581,"responseStart":0,"secureConnectionStart":0},{"duration":386.7999999523163,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":244.60000002384186,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":244.60000002384186,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":631.3999999761581,"responseStart":0,"secureConnectionStart":0},{"duration":386.7999999523163,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":244.70000004768372,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":244.70000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":631.5,"responseStart":0,"secureConnectionStart":0},{"duration":386.60000002384186,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":244.89999997615814,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":244.89999997615814,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":631.5,"responseStart":0,"secureConnectionStart":0},{"duration":386.60000002384186,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":244.89999997615814,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":244.89999997615814,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":631.5,"responseStart":0,"secureConnectionStart":0},{"duration":424.2000000476837,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":245.10000002384186,"connectEnd":245.10000002384186,"connectStart":245.10000002384186,"domainLookupEnd":245.10000002384186,"domainLookupStart":245.10000002384186,"fetchStart":245.10000002384186,"redirectEnd":0,"redirectStart":0,"requestStart":245.10000002384186,"responseEnd":669.3000000715256,"responseStart":669.3000000715256,"secureConnectionStart":245.10000002384186},{"duration":520,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":245.60000002384186,"connectEnd":245.60000002384186,"connectStart":245.60000002384186,"domainLookupEnd":245.60000002384186,"domainLookupStart":245.60000002384186,"fetchStart":245.60000002384186,"redirectEnd":0,"redirectStart":0,"requestStart":245.60000002384186,"responseEnd":765.6000000238419,"responseStart":765.6000000238419,"secureConnectionStart":245.60000002384186},{"duration":541.6000000238419,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":245.70000004768372,"connectEnd":245.70000004768372,"connectStart":245.70000004768372,"domainLookupEnd":245.70000004768372,"domainLookupStart":245.70000004768372,"fetchStart":245.70000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":245.70000004768372,"responseEnd":787.3000000715256,"responseStart":787.3000000715256,"secureConnectionStart":245.70000004768372},{"duration":542.0999999046326,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":245.80000007152557,"connectEnd":245.80000007152557,"connectStart":245.80000007152557,"domainLookupEnd":245.80000007152557,"domainLookupStart":245.80000007152557,"fetchStart":245.80000007152557,"redirectEnd":0,"redirectStart":0,"requestStart":245.80000007152557,"responseEnd":787.8999999761581,"responseStart":787.8999999761581,"secureConnectionStart":245.80000007152557},{"duration":543.2999999523163,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":246.10000002384186,"connectEnd":246.10000002384186,"connectStart":246.10000002384186,"domainLookupEnd":246.10000002384186,"domainLookupStart":246.10000002384186,"fetchStart":246.10000002384186,"redirectEnd":0,"redirectStart":0,"requestStart":246.10000002384186,"responseEnd":789.3999999761581,"responseStart":789.3999999761581,"secureConnectionStart":246.10000002384186},{"duration":544.5,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":246.20000004768372,"connectEnd":246.20000004768372,"connectStart":246.20000004768372,"domainLookupEnd":246.20000004768372,"domainLookupStart":246.20000004768372,"fetchStart":246.20000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":246.20000004768372,"responseEnd":790.7000000476837,"responseStart":790.7000000476837,"secureConnectionStart":246.20000004768372},{"duration":549.3000000715256,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":246.39999997615814,"connectEnd":246.39999997615814,"connectStart":246.39999997615814,"domainLookupEnd":246.39999997615814,"domainLookupStart":246.39999997615814,"fetchStart":246.39999997615814,"redirectEnd":0,"redirectStart":0,"requestStart":246.39999997615814,"responseEnd":795.7000000476837,"responseStart":795.6000000238419,"secureConnectionStart":246.39999997615814},{"duration":558.8000000715256,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":246.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":246.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":805.3000000715256,"responseStart":0,"secureConnectionStart":0},{"duration":550.6000000238419,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/e80c7a6aee0fa86c2b1a716575a614aa/shortcuts.js?context=issuenavigation&context=issueaction","startTime":246.5,"connectEnd":246.5,"connectStart":246.5,"domainLookupEnd":246.5,"domainLookupStart":246.5,"fetchStart":246.5,"redirectEnd":0,"redirectStart":0,"requestStart":246.5,"responseEnd":797.1000000238419,"responseStart":797.1000000238419,"secureConnectionStart":246.5},{"duration":559.5,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":246.70000004768372,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":246.70000004768372,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":806.2000000476837,"responseStart":0,"secureConnectionStart":0},{"duration":551,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":246.89999997615814,"connectEnd":246.89999997615814,"connectStart":246.89999997615814,"domainLookupEnd":246.89999997615814,"domainLookupStart":246.89999997615814,"fetchStart":246.89999997615814,"redirectEnd":0,"redirectStart":0,"requestStart":246.89999997615814,"responseEnd":797.8999999761581,"responseStart":797.8999999761581,"secureConnectionStart":246.89999997615814}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":146,"responseStart":237,"responseEnd":238,"domLoading":241,"domInteractive":2338,"domContentLoadedEventStart":2338,"domContentLoadedEventEnd":2411,"domComplete":3590,"loadEventStart":3590,"loadEventEnd":3593,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"263cffbb208771","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":62,"dbReadsTimeInMs":11,"dbConnsTimeInMs":13,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}
Hi Prasad Pise,
By looking at attached snaps,
1. We can see, asdf'OR'1'='1 string has been inserted as string value. It is not injection in SQL. With above query, sql execution will fail because there is no. space between asdf' OR '1'='1. In sql injection second boolean expression OR '1'='1 doesn't insert into database because it is logical condition.
In case of SQL injection result sould be only asdf.
2. On Employment management screen, when we add characters, system thrown server error. I want to get more inputs on this, how we identified this is SQL Injection error.
3. Deepali Tidke, Prasad is facing server error while testing self serve mode. Please get this issue resolved so that he can test sql injection in self serve mode.
CC: Samir, Rakesh Roy,