CVE-2015-10038: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in nym3r0s pplv2. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named 28f8b0550104044da09f04659797487c59f85b00. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218023.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8
Published: 2023-01-11T19:15Z
Repository: https://github.com/nym3r0s/pplv2
Language: PHP
Files changed: matchday/confirm11.php, matchday/index.php, matchday/matchday.php, matchday/playerInfo.php, matchday/squadGen.php, transfers/balance.php, transfers/confirm16.php, transfers/index.php, transfers/playerInfo.php, transfers/playersGen.php, transfers/remainingTransfers.php, transfers/transfers.php, transfers/userGen.php
Commit date: 2015-01-22 12:46:38 +0530
Commit message: Added fix for SQL Injection

Diff: diff --git a/matchday/confirm11.php b/matchday/confirm11.php
index 99dc9d6..843079a 100644
--- a/matchday/confirm11.php
+++ b/matchday/confirm11.php
@@ -1,15 +1,15 @@
 <?php
 session_start();
 require './../includes/dbconfig.php';
-$user = $_SESSION['user'];
+$user = mysql_real_escape_string($_SESSION['user'])s;
 if(!isset($user))
 {
     header('Location: ./../login.php');
 }
 
-$idString = $_POST['c11'];
+$idString = mysql_real_escape_string($_POST['c11']);
 echo($idString."\n");
 $ids = explode(',',$idString);
 sort($ids);
 
 //// For Debugging
diff --git a/matchday/index.php b/matchday/index.php
new file mode 100644
index 0000000..3f3e0a8
--- /dev/null
+++ b/matchday/index.php
@@ -0,0 +1,3 @@
+<?php
+    header('Location: ./matchday.php');
+?>
diff --git a/matchday/matchday.php b/matchday/matchday.php
index d93f0db..5dbe03c 100644
--- a/matchday/matchday.php
+++ b/matchday/matchday.php
@@ -1,9 +1,9 @@
 <?php
 session_start();
 require './../includes/dbconfig.php';
-$user = $_SESSION['user'];
+$user = mysql_real_escape_string($_SESSION['user']);
 if(!isset($user))
 {
     header('Location: ./../login.php');
 }
 
diff --git a/matchday/playerInfo.php b/matchday/playerInfo.php
index 5071270..078aa82 100644
--- a/matchday/playerInfo.php
+++ b/matchday/playerInfo.php
@@ -2,12 +2,12 @@
 session_start();
 require './../includes/dbconfig.php';
 
 //echo("done");
 
-$playerId = $_POST['req'];
-$user = $_SESSION['user'];
+$playerId = mysql_real_escape_string($_POST['req']);
+$user = mysql_real_escape_string($_SESSION['user']);
 
 if(!isset($user))
 {
     header('Location: ./../login.php');
 }
@@ -70,11 +70,11 @@ echo('<div class="panel panel-primary" id="playerProfile">');
     echo('<div class="panel-body">');
         echo('<img class="img-circle" id="playerpic" src="'.$playerPhoto.'">');
 
         echo('<div class="row_left"> <div><b>Country</b></div> <div><b>Player Role</b></div> <div><b>Matches</b></div> <div><b>Form</b></div> <div><b>Confidence</b></div> </div>');
 
-		echo('<div class="row_right"> <div>'.$playerCountry.'</div> <div>'.$playerType.'</div> <div>'.$playerMatches.'</div> <div>'.$playerForm.'</div><div>'.$playerConfidence.'</div></div>');
+        echo('<div class="row_right"> <div>'.$playerCountry.'</div> <div>'.$playerType.'</div> <div>'.$playerMatches.'</div> <div>'.$playerForm.'</div><div>'.$playerConfidence.'</div></div>');
 
 if($playerCaptain != ""){    echo('<div class="row"><b>Captain</b></div><br>'); }
         echo('</div>');
 echo('</div>');
 
diff --git a/matchday/squadGen.php b/matchday/squadGen.php
index 883c6e0..08133d6 100644
--- a/matchday/squadGen.php
+++ b/matchday/squadGen.php
@@ -1,10 +1,10 @@
 <?php
 session_start();
 require './../includes/dbconfig.php';
 
-$user = $_SESSION['user'];
+$user = mysql_real_escape_string($_SESSION['user']);
 
 
 if(!isset($user))
 {
     header('Location: ./../login.php');
diff --git a/transfers/balance.php b/transfers/balance.php
index 604c00c..95afb76 100644
--- a/transfers/balance.php
+++ b/transfers/balance.php
@@ -1,10 +1,10 @@
 <?php
 session_start();
 require './../includes/dbconfig.php';
 
-$user = $_SESSION['user'];
+$user = mysql_real_escape_string($_SESSION['user']);
 
 
 if(!isset($user))
 {
     header('Location: ./../login.php');
diff --git a/transfers/confirm16.php b/transfers/confirm16.php
index bc1d350..6c55470 100644
--- a/transfers/confirm16.php
+++ b/transfers/confirm16.php
@@ -1,15 +1,15 @@
 <?php
 session_start();
 require './../includes/dbconfig.php';
-$user = $_SESSION['user'];
+$user = mysql_real_escape_string($_SESSION['user']);
 if(!isset($user))
 {
     header('Location: ./../login.php');
 }
 
-$idString = $_POST['c16'];
+$idString = mysql_real_escape_string($_POST['c16']);
 $ids = explode(',',$idString);
 sort($ids);
 
 //// For Debugging
 //for($i=0;$i<16;$i++)
diff --git a/transfers/index.php b/transfers/index.php
new file mode 100644
index 0000000..ed5552f
--- /dev/null
+++ b/transfers/index.php
@@ -0,0 +1,3 @@
+<?php
+    header('Location: ./transfers.php');
+?>
diff --git a/transfers/playerInfo.php b/transfers/playerInfo.php
index 5071270..078aa82 100644
--- a/transfers/playerInfo.php
+++ b/transfers/playerInfo.php
@@ -2,12 +2,12 @@
 session_start();
 require './../includes/dbconfig.php';
 
 //echo("done");
 
-$playerId = $_POST['req'];
-$user = $_SESSION['user'];
+$playerId = mysql_real_escape_string($_POST['req']);
+$user = mysql_real_escape_string($_SESSION['user']);
 
 if(!isset($user))
 {
     header('Location: ./../login.php');
 }
@@ -70,11 +70,11 @@ echo('<div class="panel panel-primary" id="playerProfile">');
     echo('<div class="panel-body">');
         echo('<img class="img-circle" id="playerpic" src="'.$playerPhoto.'">');
 
         echo('<div class="row_left"> <div><b>Country</b></div> <div><b>Player Role</b></div> <div><b>Matches</b></div> <div><b>Form</b></div> <div><b>Confidence</b></div> </div>');
 
-		echo('<div class="row_right"> <div>'.$playerCountry.'</div> <div>'.$playerType.'</div> <div>'.$playerMatches.'</div> <div>'.$playerForm.'</div><div>'.$playerConfidence.'</div></div>');
+        echo('<div class="row_right"> <div>'.$playerCountry.'</div> <div>'.$playerType.'</div> <div>'.$playerMatches.'</div> <div>'.$playerForm.'</div><div>'.$playerConfidence.'</div></div>');
 
 if($playerCaptain != ""){    echo('<div class="row"><b>Captain</b></div><br>'); }
         echo('</div>');
 echo('</div>');
 
diff --git a/transfers/playersGen.php b/transfers/playersGen.php
index 771a301..8cb1752 100644
--- a/transfers/playersGen.php
+++ b/transfers/playersGen.php
@@ -1,10 +1,10 @@
 <?php
 session_start();
 require './../includes/dbconfig.php';
 
-$user = $_SESSION['user'];
+$user = mysql_real_escape_string($_SESSION['user']);
 
 
 if(!isset($user))
 {
     header('Location: ./../login.php');
diff --git a/transfers/remainingTransfers.php b/transfers/remainingTransfers.php
index 815442a..8017e85 100644
--- a/transfers/remainingTransfers.php
+++ b/transfers/remainingTransfers.php
@@ -1,9 +1,9 @@
 <?php
 session_start();
 require './../includes/dbconfig.php';
-$user = $_SESSION['user'];
+$user = mysql_real_escape_string($_SESSION['user']);
 if(!isset($user))
 {
     header('Location: ./../login.php');
 }
 
diff --git a/transfers/transfers.php b/transfers/transfers.php
index 04fb7c5..7b09d30 100644
--- a/transfers/transfers.php
+++ b/transfers/transfers.php
@@ -1,9 +1,9 @@
 <?php
 session_start();
 require './../includes/dbconfig.php';
-$user = $_SESSION['user'];
+$user = mysql_real_escape_string($_SESSION['user']);
 if(!isset($user))
 {
     header('Location: ./../login.php');
 }
 ?>
@@ -48,15 +48,15 @@ if(!isset($user))
       </div>
       </div>
     </nav>
 
 <!-- Nav  Ends here-->
-	<div class="transferDetails">
-		<div id="playerBalance"></div>
-		<div id="transferBalance"></div>
-	</div>
-		
+    <div class="transferDetails">
+        <div id="playerBalance"></div>
+        <div id="transferBalance"></div>
+    </div>
+
     <div id="switches">
         <div class="btn-group" role="group" aria-label="...">
             <div class="btn-group" role="group">
             <button type="button" id="batsman" class="btn btn-default btn-success">Batsman</button>
             </div>
diff --git a/transfers/userGen.php b/transfers/userGen.php
index 566e03f..30742a7 100644
--- a/transfers/userGen.php
+++ b/transfers/userGen.php
@@ -1,10 +1,10 @@
 <?php
 session_start();
 require './../includes/dbconfig.php';
 
-$user = $_SESSION['user'];
+$user = mysql_real_escape_string($_SESSION['user']);
 
 
 if(!isset($user))
 {
     header('Location: ./../login.php');

Vulnerable code: $user = $_SESSION['user'];
$idString = $_POST['c11'];
$user = $_SESSION['user'];
$playerId = $_POST['req'];
$user = $_SESSION['user'];
		echo('<div class="row_right"> <div>'.$playerCountry.'</div> <div>'.$playerType.'</div> <div>'.$playerMatches.'</div> <div>'.$playerForm.'</div><div>'.$playerConfidence.'</div></div>');
$user = $_SESSION['user'];
$user = $_SESSION['user'];
$user = $_SESSION['user'];
$idString = $_POST['c16'];
$playerId = $_POST['req'];
$user = $_SESSION['user'];
		echo('<div class="row_right"> <div>'.$playerCountry.'</div> <div>'.$playerType.'</div> <div>'.$playerMatches.'</div> <div>'.$playerForm.'</div><div>'.$playerConfidence.'</div></div>');
$user = $_SESSION['user'];
$user = $_SESSION['user'];
$user = $_SESSION['user'];
	<div class="transferDetails">
		<div id="playerBalance"></div>
		<div id="transferBalance"></div>
	</div>
		
$user = $_SESSION['user'];
Fixed code: $user = mysql_real_escape_string($_SESSION['user'])s;
$idString = mysql_real_escape_string($_POST['c11']);
<?php
    header('Location: ./matchday.php');
?>
$user = mysql_real_escape_string($_SESSION['user']);
$playerId = mysql_real_escape_string($_POST['req']);
$user = mysql_real_escape_string($_SESSION['user']);
        echo('<div class="row_right"> <div>'.$playerCountry.'</div> <div>'.$playerType.'</div> <div>'.$playerMatches.'</div> <div>'.$playerForm.'</div><div>'.$playerConfidence.'</div></div>');
$user = mysql_real_escape_string($_SESSION['user']);
$user = mysql_real_escape_string($_SESSION['user']);
$user = mysql_real_escape_string($_SESSION['user']);
$idString = mysql_real_escape_string($_POST['c16']);
<?php
    header('Location: ./transfers.php');
?>
$playerId = mysql_real_escape_string($_POST['req']);
$user = mysql_real_escape_string($_SESSION['user']);
        echo('<div class="row_right"> <div>'.$playerCountry.'</div> <div>'.$playerType.'</div> <div>'.$playerMatches.'</div> <div>'.$playerForm.'</div><div>'.$playerConfidence.'</div></div>');
$user = mysql_real_escape_string($_SESSION['user']);
$user = mysql_real_escape_string($_SESSION['user']);
$user = mysql_real_escape_string($_SESSION['user']);
    <div class="transferDetails">
        <div id="playerBalance"></div>
        <div id="transferBalance"></div>
    </div>

$user = mysql_real_escape_string($_SESSION['user']);