roottusk / vapi

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.
GNU General Public License v3.0
1.17k stars 303 forks source link

fix(api1:createUser): mysql INSERT statement #1

Closed PauloASilva closed 3 years ago

PauloASilva commented 3 years ago

Hi, Following docker setup instructions as per the README, without a custom MySQL configuration file, I was not being able to create new users:

{
  "status": 400,
  "userCreated": "false",
  "cause": "dbInsertionFailed"
}

This PR should fix it.

Cheers, Paulo A. Silva

roottusk commented 3 years ago

The Postman request to this endpoint shouldnt have blank characters otherwise it wont insert in DB. Thank you for the PR

PauloASilva commented 3 years ago

The Postman request to this endpoint shouldnt have blank characters otherwise it wont insert in DB. Thank you for the PR

Not sure I understood your comment.

This is the original request:

POST /vapi/api1/createUser.php HTTP/1.1
User-Agent: PostmanRuntime/7.26.10
Accept: */*
Cache-Control: no-cache
Host: localhost
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 77

username=macgyver&name=Angus%20MacGyver&course=secret%20agent&password=123456

and this is the response:

HTTP/1.1 200 OK
Date: Mon, 03 May 2021 14:26:56 GMT
Server: Apache/2.4.38 (Debian)
X-Powered-By: PHP/7.4.7
Content-Length: 64
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/json
{"status":400,"userCreated":"false","cause":"dbInsertionFailed"}

This is the issue

$query="INSERT into api1users values('','$username','$name','$course','$password')";

Without additional/custom MySQL configuration '' is not a valid value for api1users.id. Adding columns names to the SQL statement fixes the issue.

Cheers, Paulo A. Silva

roottusk commented 3 years ago

Yes , I have merged the request . Thank you for the fix