CVE-2023-52082: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Lychee is a free photo-management tool.  Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe.  The patch is provided on version 5.0.2.  To work around this issue, disable SQL EXPLAIN logging.

CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-12-28T16:16Z
Repository: https://github.com/LycheeOrg/Lychee
Language: PHP
Files changed: app/Providers/AppServiceProvider.php, database/migrations/2023_12_28_144906_bump_version050002.php, resources/views/livewire/forms/album/share-with.blade.php, version.md
Commit date: 2023-12-28 16:15:36 +0100
Commit message: Fix Injection + v5.0.2 (#2123)


Diff: diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php
index 423f5162..ebc70ad9 100644
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -221,11 +221,11 @@ class AppServiceProvider extends ServiceProvider
 			};
 		})->all();
 
 		$sql_with_bindings = Str::replaceArray('?', $bindings, $query->sql);
 
-		$explain = DB::select('EXPLAIN ' . $sql_with_bindings);
+		$explain = DB::select('EXPLAIN ' . $query->sql, $query->bindings);
 		$renderer = new ArrayToTextTable();
 		$renderer->setIgnoredKeys(['possible_keys', 'key_len', 'ref']);
 
 		$msg .= PHP_EOL;
 		$msg .= Str::repeat('-', 20) . PHP_EOL;
diff --git a/database/migrations/2023_12_28_144906_bump_version050002.php b/database/migrations/2023_12_28_144906_bump_version050002.php
new file mode 100644
index 00000000..88457c87
--- /dev/null
+++ b/database/migrations/2023_12_28_144906_bump_version050002.php
@@ -0,0 +1,26 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class() extends Migration {
+	/**
+	 * Run the migrations.
+	 *
+	 * @return void
+	 */
+	public function up(): void
+	{
+		DB::table('configs')->where('key', 'version')->update(['value' => '050002']);
+	}
+
+	/**
+	 * Reverse the migrations.
+	 *
+	 * @return void
+	 */
+	public function down(): void
+	{
+		DB::table('configs')->where('key', 'version')->update(['value' => '050001']);
+	}
+};
diff --git a/resources/views/livewire/forms/album/share-with.blade.php b/resources/views/livewire/forms/album/share-with.blade.php
index c5b21df4..ed61bb23 100644
--- a/resources/views/livewire/forms/album/share-with.blade.php
+++ b/resources/views/livewire/forms/album/share-with.blade.php
@@ -94,14 +94,14 @@
                         @if (count($this->userList) > 0)
                             <ul class=" max-h-[50vh] overflow-y-auto">
                                 @foreach ($this->userList as $result)
                                     <li class="border-b border-neutral-700 cursor-pointer transition-all ease-in-out duration-300
 							hover:bg-gradient-to-b hover:from-primary-500 hover:to-primary-600 hover:text-text-main-0"
-                                        wire:click="select('{{ $result['id'] }}','{{ $result['username'] }}')">
+                                        wire:click="select('{{ $result['id'] }}',@js($result['username']))">
                                         <a class="px-1 py-1 flex items-center"
                                             @if ($loop->last) @keydown.tab="isSearchUserOpen = false" @endif>
-                                            <span class="ml-4 text-left">{{ $result['username'] }}</span>
+                                            <span class="ml-4 text-left">{{ ($result['username']) }}</span>
                                         </a>
                                     </li>
                                 @endforeach
                             </ul>
                         @else
diff --git a/version.md b/version.md
index 32f3eaad..3e827a3a 100644
--- a/version.md
+++ b/version.md
@@ -1 +1 @@
-5.0.1
\ No newline at end of file
+5.0.2
\ No newline at end of file

Vulnerable code: 		$explain = DB::select('EXPLAIN ' . $sql_with_bindings);
                                        wire:click="select('{{ $result['id'] }}','{{ $result['username'] }}')">
                                            <span class="ml-4 text-left">{{ $result['username'] }}</span>
5.0.1
Fixed code: 		$explain = DB::select('EXPLAIN ' . $query->sql, $query->bindings);
<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Support\Facades\DB;

return new class() extends Migration {
	/**
	 * Run the migrations.
	 *
	 * @return void
	 */
	public function up(): void
	{
		DB::table('configs')->where('key', 'version')->update(['value' => '050002']);
	}

	/**
	 * Reverse the migrations.
	 *
	 * @return void
	 */
	public function down(): void
	{
		DB::table('configs')->where('key', 'version')->update(['value' => '050001']);
	}
};
                                        wire:click="select('{{ $result['id'] }}',@js($result['username']))">
                                            <span class="ml-4 text-left">{{ ($result['username']) }}</span>
5.0.2