This project focuses on the analysis and remediation of security vulnerabilities within a simple Student Management System built with Python Flask and SQLite.
Originally, the application was intentionally vulnerable to common web attacks. [cite_start]This repository documents the process of identifying these flaws and implementing secure coding practices to patch them, satisfying the requirements for the Cybersecurity (Keamanan Siber) course at Telkom University[cite: 1, 2, 5].
- [cite_start]Rafif Baltirus Budiman (1301204443) - Environment setup, SQL Injection patching, and reporting[cite: 9].
- [cite_start]Faisal Surya Saputra (103012330152) - Authentication implementation, XSS patching, and penetration testing[cite: 9].
- [cite_start]Rafie Novianto Sudrajat (103012500133) - CSRF protection (Secret Key configuration) and research[cite: 9].
The following Common Weakness Enumerations (CWE) were identified and resolved:
- Vulnerability: The application lacked login functionality. [cite_start]Critical actions (Create, Read, Update, Delete) were accessible to anonymous users via direct URL manipulation[cite: 36, 38].
- [cite_start]Fix: Implemented a login route, session management (
session['logged_in']), and access control checks on all sensitive routes[cite: 60, 65].
- [cite_start]Vulnerability: User input was rendered in
index.htmlusing the|safefilter, allowing malicious JavaScript (e.g.,<script>alert('XSS')</script>) to execute in the browser[cite: 106, 110]. - [cite_start]Fix: Removed the
|safefilter to allow Jinja2's auto-escaping mechanism to neutralize HTML tags[cite: 137].
- [cite_start]Vulnerability: The application used Python f-strings to construct raw SQL queries, allowing attackers to manipulate database commands[cite: 166, 170].
- Vulnerable Code:
cursor.execute(f"INSERT ... VALUES ('{name}')")
- Vulnerable Code:
- [cite_start]Fix: Replaced raw queries with parameterized queries using
?placeholders, ensuring inputs are treated as data, not executable code[cite: 191].
- [cite_start]Vulnerability: The application accepted POST requests without verification, allowing external sites to trigger unwanted actions on behalf of a logged-in user[cite: 209, 215].
- Fix: Integrated Flask-WTF and
CSRFProtect. [cite_start]Added aSECRET_KEYand included hidden CSRF tokens in HTML forms[cite: 280, 285].
-
Clone the repository
git clone [https://github.com/yourusername/flask-web-security-patching.git](https://github.com/yourusername/flask-web-security-patching.git) cd flask-web-security-patching -
Set up Virtual Environment
python -m venv .venv # Windows .venv\Scripts\Activate # macOS/Linux source .venv/bin/activate
-
Install Dependencies
pip install flask flask_sqlalchemy flask_wtf
-
Run the Application
python app.py
[cite_start]Access the app at
http://127.0.0.1:5000[cite: 25].
- Language: Python
- Framework: Flask
- Database: SQLite / SQLAlchemy
- Security Libraries: Flask-WTF (CSRF Protection)
Disclaimer: This project is for educational purposes to demonstrate secure coding practices.