CVE-2015-10097: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in grinnellplans-php up to 3.0. It has been declared as critical. Affected by this vulnerability is the function interface_disp_page/interface_disp_page of the file read.php. The manipulation leads to sql injection. The attack can be launched remotely. The identifier of the patch is 57e4409e19203a94495140ff1b5a697734d17cfb. It is recommended to apply a patch to fix this issue. The identifier VDB-223801 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-03-25T18:15Z
Repository: https://github.com/grinnellplans/grinnellplans-php
Language: PHP
Files changed: read.php
Commit date: 2015-04-04 13:53:40 +0000
Commit message: Fix SQL injection in read.php's  - thanks, stjohns\!
Diff: diff --git a/read.php b/read.php
index f4eb4a5..5ebe0b5 100755
--- a/read.php
+++ b/read.php
@@ -69,11 +69,11 @@ if (!$searchnum) //if no search number given
 //begin displaying if there is a user with name or number given
 // Create the new page
 if (User::logged_in()) {
     //TODO add searchname instead?
     $page->url = add_param($page->url, 'searchnum', $searchnum);
-    $addtolist = (isset($_POST['addtolist']) ? $_POST['addtolist'] : false);
+    $addtolist = (isset($_POST['addtolist']) ? (bool)$_POST['addtolist'] : false);
     // if person is manipulating which tier this plan is on their autoread list
     if (isset($_POST['block_user'])) {
         if ($_POST['block_user'] == 1) {
             $user = User::get();
             if ($user->webview == 1) {
@@ -89,16 +89,16 @@ simply by logging out. If you would like to change this setting, please visit
         } else {
             Block::removeBlock($idcookie, $searchnum);
             $msg = new InfoText("User " . $planinfo[0][0] . " has been unblocked.");
         }
         $page->append($msg);
-    } else if ($addtolist == 1) {
-        $privlevel = (isset($_POST['privlevel']) ? $_POST['privlevel'] : 0);
+    } else if ($addtolist) {
+        $privlevel = (isset($_POST['privlevel']) ? (int)$_POST['privlevel'] : 0);
         if ($privlevel == 0) {
             mysql_query("DELETE FROM autofinger WHERE owner = '$idcookie' and interest = '$searchnum'");
             $yay = new InfoText("User " . $planinfo[0][0] . " removed from your autoread list.");
-        } else {
+        } else if ($privlevel > 0 && $privlevel <= 3) {
             mysql_query("INSERT INTO autofinger (owner, interest, priority) VALUES ('$idcookie', '$searchnum', '$privlevel') ON DUPLICATE KEY UPDATE priority=$privlevel");
             $yay = new InfoText("User " . $planinfo[0][0] . " is now on your autoread list with priority level of " . $privlevel . ".");
         }
         $page->append($yay);
     }

Vulnerable code:     $addtolist = (isset($_POST['addtolist']) ? $_POST['addtolist'] : false);
    } else if ($addtolist == 1) {
        $privlevel = (isset($_POST['privlevel']) ? $_POST['privlevel'] : 0);
        } else {
Fixed code:     $addtolist = (isset($_POST['addtolist']) ? (bool)$_POST['addtolist'] : false);
    } else if ($addtolist) {
        $privlevel = (isset($_POST['privlevel']) ? (int)$_POST['privlevel'] : 0);
        } else if ($privlevel > 0 && $privlevel <= 3) {