CVE-2018-9250: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2018-05-18T14:29Z
Repository: https://github.com/openemr/openemr
Language: PHP
Files changed: interface/super/edit_list.php
Commit date: 2018-04-26 00:20:46 -0700
Commit message: security fix (#1578)


Diff: diff --git a/interface/super/edit_list.php b/interface/super/edit_list.php
index 10be1d8416..f9eeaf9a51 100644
--- a/interface/super/edit_list.php
+++ b/interface/super/edit_list.php
@@ -1,36 +1,26 @@
 <?php
 /**
  * Administration Lists Module.
  *
- * Copyright (C) 2007-2017 Rod Roark <rod@sunsetsystems.com>
- * Copyright (C) 2017      Brady Miller <brady.g.miller@gmail.com>
- *
- * LICENSE: This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
- *
- * @package OpenEMR
- * @author  Rod Roark <rod@sunsetsystems.com>
- * @author  Brady Miller <brady.g.miller@gmail.com>
- * @author  Teny <teny@zhservices.com>
- * @link    http://www.open-emr.org
+ * @package   OpenEMR
+ * @link      http://www.open-emr.org
+ * @author    Rod Roark <rod@sunsetsystems.com>
+ * @author    Brady Miller <brady.g.miller@gmail.com>
+ * @author    Teny <teny@zhservices.com>
+ * @copyright Copyright (c) 2007-2017 Rod Roark <rod@sunsetsystems.com>
+ * @copyright Copyright (c) 2017-2018 Brady Miller <brady.g.miller@gmail.com>
+ * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
 require_once("../globals.php");
 require_once("$srcdir/acl.inc");
 require_once("$phpgacl_location/gacl_api.class.php");
 require_once("$srcdir/lists.inc");
 require_once("../../custom/code_types.inc.php");
 require_once("$srcdir/options.inc.php");
+
 use OpenEMR\Core\Header;
 
 // Below allows the list to default to the first item on the list
 //   when list_id is blank.
 $blank_list_id = '';
@@ -223,16 +213,11 @@ if ($_POST['formaction'] == 'save' && $list_id) {
     $row = sqlQuery("SELECT max(seq) AS maxseq FROM list_options WHERE list_id= 'lists'");
 
     // add the new list to the list-of-lists
     sqlInsert("INSERT INTO list_options ( " .
         "list_id, option_id, title, seq, is_default, option_value " .
-        ") VALUES ( " .
-        "'lists'," . // the master list-of-lists
-        "'" . $newlistID . "'," .
-        "'" . $_POST['newlistname'] . "', " .
-        "'" . ($row['maxseq'] + 1) . "'," .
-        "'1', '0')");
+        ") VALUES ( 'lists', ?, ?, ?, '1', '0')", array($newlistID, $_POST['newlistname'], ($row['maxseq'] + 1)));
     $list_id = $newlistID;
 } elseif ($_POST['formaction'] == 'deletelist') {
     // delete the lists options
     sqlStatement("DELETE FROM list_options WHERE list_id = '" . $_POST['list_id'] . "'");
     // delete the list from the master list-of-lists
@@ -323,11 +308,11 @@ function writeOptionLine(
 
     echo "  <td>";
     echo "<input type='checkbox' name='opt[$opt_line_no][default]' value='1' " .
         "onclick='defClicked($opt_line_no)' class='optin'$checked />";
     echo "</td>\n";
-    
+
     if (preg_match('/Eye_QP_/', $list_id)) {
         echo "  <td>";
         echo "<select name='opt[$opt_line_no][activity]' class='optin'>";
         foreach (array(
                      1 => xl('Replace'),

Vulnerable code:  * Copyright (C) 2007-2017 Rod Roark <rod@sunsetsystems.com>
 * Copyright (C) 2017      Brady Miller <brady.g.miller@gmail.com>
 *
 * LICENSE: This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 * You should have received a copy of the GNU General Public License
 * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
 *
 * @package OpenEMR
 * @author  Rod Roark <rod@sunsetsystems.com>
 * @author  Brady Miller <brady.g.miller@gmail.com>
 * @author  Teny <teny@zhservices.com>
 * @link    http://www.open-emr.org
        ") VALUES ( " .
        "'lists'," . // the master list-of-lists
        "'" . $newlistID . "'," .
        "'" . $_POST['newlistname'] . "', " .
        "'" . ($row['maxseq'] + 1) . "'," .
        "'1', '0')");
    
Fixed code:  * @package   OpenEMR
 * @link      http://www.open-emr.org
 * @author    Rod Roark <rod@sunsetsystems.com>
 * @author    Brady Miller <brady.g.miller@gmail.com>
 * @author    Teny <teny@zhservices.com>
 * @copyright Copyright (c) 2007-2017 Rod Roark <rod@sunsetsystems.com>
 * @copyright Copyright (c) 2017-2018 Brady Miller <brady.g.miller@gmail.com>
 * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3

        ") VALUES ( 'lists', ?, ?, ?, '1', '0')", array($newlistID, $_POST['newlistname'], ($row['maxseq'] + 1)));