CVE-2017-1000423: Improper Input Validation (CWE-20)
value: b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2018-01-02T20:29Z
Repository: https://github.com/b2evolution/b2evolution
Language: PHP
Files changed: install/_functions_install.php
Commit date: 2017-08-09 12:27:27 +0300
Commit message: Format install params

Diff: diff --git a/install/_functions_install.php b/install/_functions_install.php
index 27d76ae342..c4c2e16055 100644
--- a/install/_functions_install.php
+++ b/install/_functions_install.php
@@ -1789,10 +1789,22 @@ function check_quick_install_request()
 
 	return true;
 }
 
 
+/**
+ * Format an install param like DB config and base url
+ *
+ * @return string
+ */
+function format_install_param( $value )
+{
+	$value = str_replace( array( "'",  "\$" ), array( "\'", "\\$" ), $value );
+	return preg_replace( "#([\\\\]*)(\\\\\\\')#", "\\\\\\\\\\\\\\\\\'", $value );
+}
+
+
 /**
  * Update file /conf/_basic_config.php
  *
  * @param string Current action, updated by reference
  * @param array Params
@@ -1889,17 +1901,17 @@ function update_basic_config_file( $params = array() )
 				"#admin_email\s*=\s*'.*?';#",
 				"#config_is_done\s*=.*?;#",
 			),
 			array(
 				"\$db_config = array(\n"
-					."\t'user'     => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_user'] )."',\$1"
-					."\t'password' => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_password'] )."',\$2"
-					."\t'name'     => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_name'] )."',\$3"
-					."\t'host'     => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_host'] )."',\$4",
-				"tableprefix = '".str_replace( "'", "\'", $params['db_tableprefix'] )."';",
-				"baseurl = '".str_replace( "'", "\'", $params['baseurl'] )."';",
-				"admin_email = '".str_replace( "'", "\'", $params['admin_email'] )."';",
+					."\t'user'     => '".format_install_param( $params['db_user'] )."',\$1"
+					."\t'password' => '".format_install_param( $params['db_password'] )."',\$2"
+					."\t'name'     => '".format_install_param( $params['db_name'] )."',\$3"
+					."\t'host'     => '".format_install_param( $params['db_host'] )."',\$4",
+				"tableprefix = '".format_install_param( $params['db_tableprefix'] )."';",
+				"baseurl = '".format_install_param( $params['baseurl'] )."';",
+				"admin_email = '".format_install_param( $params['admin_email'] )."';",
 				'config_is_done = 1;',
 			), $conf );
 
 		// Write new contents:
 		if( save_to_file( $conf, $conf_filepath, 'w' ) )

Vulnerable code: 					."\t'user'     => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_user'] )."',\$1"
					."\t'password' => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_password'] )."',\$2"
					."\t'name'     => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_name'] )."',\$3"
					."\t'host'     => '".str_replace( array( "'", "\$" ), array( "\'", "\\$" ), $params['db_host'] )."',\$4",
				"tableprefix = '".str_replace( "'", "\'", $params['db_tableprefix'] )."';",
				"baseurl = '".str_replace( "'", "\'", $params['baseurl'] )."';",
				"admin_email = '".str_replace( "'", "\'", $params['admin_email'] )."';",
Fixed code: /**
 * Format an install param like DB config and base url
 *
 * @return string
 */
function format_install_param( $value )
{
	$value = str_replace( array( "'",  "\$" ), array( "\'", "\\$" ), $value );
	return preg_replace( "#([\\\\]*)(\\\\\\\')#", "\\\\\\\\\\\\\\\\\'", $value );
}


					."\t'user'     => '".format_install_param( $params['db_user'] )."',\$1"
					."\t'password' => '".format_install_param( $params['db_password'] )."',\$2"
					."\t'name'     => '".format_install_param( $params['db_name'] )."',\$3"
					."\t'host'     => '".format_install_param( $params['db_host'] )."',\$4",
				"tableprefix = '".format_install_param( $params['db_tableprefix'] )."';",
				"baseurl = '".format_install_param( $params['baseurl'] )."';",
				"admin_email = '".format_install_param( $params['admin_email'] )."';",