CVE-2018-1000882: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attack appear to be exploitable via HTTP GET Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2018-12-20T17:29Z
Repository: https://github.com/renlok/WeBid
Language: PHP
Files changed: active_auctions.php, admin/editauction.php, bid.php, closed_auctions.php, getthumb.php, includes/browseitems.inc.php, includes/functions_sell.php, index.php, item.php, register.php, themes/adminClassic/editauction.tpl, themes/adminModern/editauction.tpl, themes/classic/item.tpl, themes/modern/item.tpl, user_login.php, yourauctions.php, yourauctions_c.php, yourauctions_p.php, yourauctions_s.php, yourauctions_sold.php
Commit date: 2018-11-22 01:36:55 +0000
Commit message: Number of secerity fixes & fix for setup fee #510

Diff: diff --git a/active_auctions.php b/active_auctions.php
index e90c9a4d..2caadddd 100644
--- a/active_auctions.php
+++ b/active_auctions.php
@@ -64,11 +64,11 @@ $params[] = array(':perpage', $system->SETTINGS['perpage'], 'int');
 $db->query($query, $params);
 
 $k = 0;
 while ($row = $db->fetch()) {
     if (strlen($row['pict_url']) > 0) {
-        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
+        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
     } else {
         $row['pict_url'] = get_lang_img('nopicture.gif');
     }
 
     $current_time = new DateTime('now', $dt->UTCtimezone);
diff --git a/admin/editauction.php b/admin/editauction.php
index ff16e1c3..26757aa7 100644
--- a/admin/editauction.php
+++ b/admin/editauction.php
@@ -34,11 +34,11 @@ function load_gallery($auc_id)
     $UPLOADED_PICTURES = array();
     if (is_dir(UPLOAD_PATH . $auc_id)) {
         if ($dir = opendir(UPLOAD_PATH . $auc_id)) {
             while ($file = @readdir($dir)) {
                 if ($file != '.' && $file != '..' && strpos($file, 'thumb-') === false) {
-                    $UPLOADED_PICTURES[] = UPLOAD_FOLDER . $auc_id . '/' . $file;
+                    $UPLOADED_PICTURES[] = $file;
                 }
             }
             closedir($dir);
         }
     }
diff --git a/bid.php b/bid.php
index 065e96f3..c8eecb25 100644
--- a/bid.php
+++ b/bid.php
@@ -559,11 +559,11 @@ if (!isset($_POST['action']) || isset($errmsg)) {
     $template->assign_vars(array(
             'PAGE' => 1,
             'ERROR' => (isset($errmsg)) ? $errmsg : '',
             'BID_HISTORY' => (isset($ARETHEREBIDS)) ? $ARETHEREBIDS : '',
             'ID' => $id,
-            'IMAGE' => (!empty($pict_url_plain)) ? '<img src="getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $id . '/' . $pict_url_plain . '" border="0" align="center">' : '&nbsp;',
+            'IMAGE' => (!empty($pict_url_plain)) ? '<img src="getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $id . '&fromfile=' . $pict_url_plain . '" border="0" align="center">' : '',
             'TITLE' => $item_title,
             'CURRENT_BID' => $system->print_money($cbid),
             'ATYPE' => $atype,
             'BID' => $system->print_money_nosymbol($bid),
             'NEXT_BID' => $system->print_money($next_bid),
diff --git a/closed_auctions.php b/closed_auctions.php
index 660bef21..f12a162f 100644
--- a/closed_auctions.php
+++ b/closed_auctions.php
@@ -63,11 +63,11 @@ $auction_data = $db->fetchall();
 foreach ($auction_data as $row) {
     $bid = $row['current_bid'];
     $starting_price = $row['current_bid'];
 
     if (strlen($row['pict_url']) > 0) {
-        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
+        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
     } else {
         $row['pict_url'] = get_lang_img('nopicture.gif');
     }
 
     // number of bids for this auction
diff --git a/getthumb.php b/getthumb.php
index 76f753c8..848e835a 100644
--- a/getthumb.php
+++ b/getthumb.php
@@ -12,13 +12,35 @@
  *   sold. If you have been sold this script, get a refund.
  ***************************************************************************/
 
 include 'common.php';
 
+// get passed values
 $w = (isset($_GET['w'])) ? intval($_GET['w']) : '';
-$_w = $w;
-$fromfile = (isset($_GET['fromfile'])) ? $_GET['fromfile'] : '';
+$fromfile = $_GET['fromfile'];
+$auction_id = $_GET['auction_id'];
+
+// check passed values
+if (!isset($_GET['fromfile']) ||
+	!isset($_GET['auction_id']) || !is_numeric($auction_id)) {
+    ErrorPNG($ERR_716);
+    exit;
+} elseif (!file_exists($_GET['fromfile']) && !fopen($_GET['fromfile'], 'r')) {
+    ErrorPNG($ERR_716);
+    exit;
+}
+
+if ($fromfile != '') {
+	// clean fromfile
+	$fromfile = basename($fromfile);
+	// build file path
+	$file_path = UPLOAD_FOLDER . $auction_id . '/' . $fromfile;
+} else {
+	// if empty filename just show default image
+	$file_path = MAIN_PATH . 'images/email_alerts/default_item_img.jpg';
+}
+
 $nomanage = false;
 $accepted_widths = array(
     $system->SETTINGS['thumb_show'],
     $system->SETTINGS['thumb_list'],
     430,
@@ -45,21 +67,12 @@ function load_image($file, $mime, $image_type, $output_type)
     $funcall = "image$output_type";
     $funcall($image);
     exit;
 }
 
-// control parameters and file existence
-if (!isset($_GET['fromfile']) || $fromfile == '') {
-    ErrorPNG($ERR_716);
-    exit;
-} elseif (!file_exists($_GET['fromfile']) && !fopen($_GET['fromfile'], 'r')) {
-    ErrorPNG($ERR_716);
-    exit;
-}
-
 if (file_exists(UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile))) {
-    $img = getimagesize($fromfile);
+    $img = getimagesize($file_path);
     switch ($img[2]) {
         case IMAGETYPE_GIF:
             if (!(imagetypes() &IMG_GIF)) {
                 if (!function_exists('imagecreatefromgif')) {
                     $nomanage = true;
@@ -96,11 +109,11 @@ if (file_exists(UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile))) {
     if (function_exists('imagetypes')) {
         if (!is_dir(UPLOAD_PATH . 'cache')) {
             mkdir(UPLOAD_PATH . 'cache', 0777);
         }
 
-        $img = @getimagesize($fromfile);
+        $img = @getimagesize($file_path);
         if (is_array($img)) {
             switch ($img[2]) {
                 case IMAGETYPE_GIF:
                     if (!(imagetypes() &IMG_GIF)) {
                         if (!function_exists('imagecreatefromgif')) {
@@ -139,11 +152,11 @@ if (file_exists(UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile))) {
             ErrorPNG($ERR_710);
             exit;
         }
         if ($w == '') {
             // just load the image
-            load_image($fromfile, $img['mime'], $image_type, $output_type);
+            load_image($file_path, $img['mime'], $image_type, $output_type);
         } else {
             // check image orientation
             if ($img[0] < $img[1]) {
                 $h = $w;
                 $ratio = floatval($img[1] / $h);
@@ -154,13 +167,13 @@ if (file_exists(UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile))) {
             }
         
             $ou = imagecreatetruecolor($w, $h);
             imagealphablending($ou, false);
             $funcall = "imagecreatefrom$image_type";
-            imagecopyresampled($ou, $funcall($fromfile), 0, 0, 0, 0, $w, $h, $img[0], $img[1]);
+            imagecopyresampled($ou, $funcall($file_path), 0, 0, 0, 0, $w, $h, $img[0], $img[1]);
             $funcall = "image$output_type";
-            $funcall($ou, UPLOAD_PATH . 'cache/' . $_w . '-' . md5($fromfile));
+            $funcall($ou, UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile));
             header('Content-type: ' . $img['mime']);
             $funcall($ou);
             exit;
         }
     } else {
diff --git a/includes/browseitems.inc.php b/includes/browseitems.inc.php
index b7cdf685..341b6def 100644
--- a/includes/browseitems.inc.php
+++ b/includes/browseitems.inc.php
@@ -114,11 +114,11 @@ function build_items($row)
 {
     global $system;
 
     // image icon
     if (!empty($row['pict_url'])) {
-        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_list'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
+        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_list'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
     } else {
         $row['pict_url'] = get_lang_img('nopicture.gif');
     }
 
     if ($row['current_bid'] == 0) {
diff --git a/includes/functions_sell.php b/includes/functions_sell.php
index 08b4c4da..327dcc77 100644
--- a/includes/functions_sell.php
+++ b/includes/functions_sell.php
@@ -396,11 +396,11 @@ function get_fee($minimum_bid, $just_fee = true)
         'buynow_fee' => 0,
         'picture_fee' => 0,
         'extracat_fee' => 0
     );
     while ($row = $db->fetch()) {
-        if ($minimum_bid >= $row['fee_from'] && $minimum_bid <= $row['fee_to'] && $row['type'] == 'setup') {
+        if ($minimum_bid >= $row['fee_from'] && $minimum_bid <= $row['fee_to'] && $row['type'] == 'setup_fee') {
             if ($row['fee_type'] == 'flat') {
                 $fee_data['setup_fee'] = $row['value'];
                 $fee_value = bcadd($fee_value, $row['value'], $system->SETTINGS['moneydecimals']);
             } else {
                 $tmp = bcdiv($row['value'], '100', $system->SETTINGS['moneydecimals']);
diff --git a/index.php b/index.php
index ceace577..994f00ce 100644
--- a/index.php
+++ b/index.php
@@ -102,11 +102,11 @@ while ($row = $db->fetch()) {
     $high_bid = ($row['bn_only']) ? $row['buy_now'] : $high_bid;
     $template->assign_block_vars('featured', array(
             'ENDS' => $ends_string,
             'ID' => $row['id'],
             'BID' => $system->print_money($high_bid),
-            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&amp;fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'] : 'images/email_alerts/default_item_img.jpg',
+            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'] : '',
             'TITLE' => htmlspecialchars($row['title'])
             ));
     $i++;
 }
 
@@ -186,11 +186,11 @@ while ($row = $db->fetch()) {
     $high_bid = ($row['num_bids'] == 0) ? $row['minimum_bid'] : $row['current_bid'];
     $template->assign_block_vars('hotitems', array(
             'ENDS' => $ends_string,
             'ID' => $row['id'],
             'BID' => $system->print_money($high_bid),
-            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&amp;fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'] : 'images/email_alerts/default_item_img.jpg',
+            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&amp;fromfile=' . $row['pict_url'] : '',
             'TITLE' => htmlspecialchars($row['title'])
             ));
 }
 $hot_items = ($i > 0) ? true : false;
 
diff --git a/item.php b/item.php
index b1cc285e..b0b768ec 100644
--- a/item.php
+++ b/item.php
@@ -464,11 +464,11 @@ if ($auction_data['shipping'] == 1) {
 $template->assign_vars(array(
         'ID' => $auction_data['id'],
         'TITLE' => htmlspecialchars($auction_data['title']),
         'SUBTITLE' => htmlspecialchars($auction_data['subtitle']),
         'AUCTION_DESCRIPTION' => $auction_data['description'],
-        'PIC_URL' => UPLOAD_FOLDER . $id . '/' . $auction_data['pict_url'],
+        'PIC_URL' => $auction_data['pict_url'],
         'SHIPPING_COST' => ($auction_data['shipping_cost'] > 0) ? $system->print_money($auction_data['shipping_cost']) : $MSG['1152'],
         'ADDITIONAL_SHIPPING_COST' => $system->print_money($auction_data['additional_shipping_cost']),
         'COUNTRY' => $auction_data['country'],
         'CITY' => $auction_data['city'],
         'ZIP' => $auction_data['zip'],
diff --git a/register.php b/register.php
index a5021b23..0f616734 100644
--- a/register.php
+++ b/register.php
@@ -446,19 +446,19 @@ $template->assign_vars(array(
         'MISSING11' => ($missing['tel']) ? 1 : 0,
         'FEES'=> $system->print_money($signup_fee),
 
         'V_YNEWSL' => ((isset($_POST['TPL_nletter']) && $_POST['TPL_nletter'] == 1) || !isset($_POST['TPL_nletter'])) ? 'checked=true' : '',
         'V_NNEWSL' => (isset($_POST['TPL_nletter']) && $_POST['TPL_nletter'] == 2) ? 'checked=true' : '',
-        'V_YNAME' => (isset($_POST['TPL_name'])) ? $_POST['TPL_name'] : '',
-        'V_UNAME' => (isset($_POST['TPL_nick'])) ? $_POST['TPL_nick'] : '',
-        'V_EMAIL' => (isset($_POST['TPL_email'])) ? $_POST['TPL_email'] : '',
-        'V_YEAR' => (isset($_POST['TPL_year'])) ? $_POST['TPL_year'] : '',
-        'V_ADDRE' => (isset($_POST['TPL_address'])) ? $_POST['TPL_address'] : '',
-        'V_CITY' => (isset($_POST['TPL_city'])) ? $_POST['TPL_city'] : '',
-        'V_PROV' => (isset($_POST['TPL_prov'])) ? $_POST['TPL_prov'] : '',
-        'V_POSTCODE' => (isset($_POST['TPL_zip'])) ? $_POST['TPL_zip'] : '',
-        'V_PHONE' => (isset($_POST['TPL_phone'])) ? $_POST['TPL_phone'] : ''
+        'V_YNAME' => (isset($_POST['TPL_name'])) ? $system->cleanvars($_POST['TPL_name']) : '',
+        'V_UNAME' => (isset($_POST['TPL_nick'])) ? $system->cleanvars($_POST['TPL_nick']) : '',
+        'V_EMAIL' => (isset($_POST['TPL_email'])) ? $system->cleanvars($_POST['TPL_email']) : '',
+        'V_YEAR' => (isset($_POST['TPL_year'])) ? $system->cleanvars($_POST['TPL_year']) : '',
+        'V_ADDRE' => (isset($_POST['TPL_address'])) ? $system->cleanvars($_POST['TPL_address']) : '',
+        'V_CITY' => (isset($_POST['TPL_city'])) ? $system->cleanvars($_POST['TPL_city']) : '',
+        'V_PROV' => (isset($_POST['TPL_prov'])) ? $system->cleanvars($_POST['TPL_prov']) : '',
+        'V_POSTCODE' => (isset($_POST['TPL_zip'])) ? $system->cleanvars($_POST['TPL_zip']) : '',
+        'V_PHONE' => (isset($_POST['TPL_phone'])) ? $system->cleanvars($_POST['TPL_phone']) : ''
         ));
 
 include 'header.php';
 $template->set_filenames(array(
         'body' => 'register.tpl'
diff --git a/themes/adminClassic/editauction.tpl b/themes/adminClassic/editauction.tpl
index e2d35e40..589ccc18 100644
--- a/themes/adminClassic/editauction.tpl
+++ b/themes/adminClassic/editauction.tpl
@@ -69,11 +69,11 @@
 						<td>
 							<div>{L_1105}</div>
 <!-- BEGIN gallery -->
 							<div class="button" style=" height:100px; float:left; margin:5px; padding:10px 5px 20px 10px;">
 								<a href="{SITEURL}/{gallery.V}" title="{gallery.V}" target="_blank">
-									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}" border="0" height="100px">
+									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}&auction_id={ID}" border="0" height="100px">
 								</a><br>
 								<input type="checkbox" name="gallery[]" value="{gallery.V}">
 							</div>
 <!-- END gallery -->
 						</td>
diff --git a/themes/adminModern/editauction.tpl b/themes/adminModern/editauction.tpl
index 4e290a7e..c11f7b12 100644
--- a/themes/adminModern/editauction.tpl
+++ b/themes/adminModern/editauction.tpl
@@ -69,11 +69,11 @@
 						<td>
 							<div>{L_1105}</div>
 <!-- BEGIN gallery -->
 							<div style="width:50px; float: left;">
 								<a href="{SITEURL}/{gallery.V}" title="{gallery.V}" target="_blank">
-									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}" border="0" hspace="10">
+									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}&auction_id={ID}" border="0" hspace="10">
 								</a>
 								<input type="checkbox" name="gallery[]" value="{gallery.V}">
 							</div>
 <!-- END gallery -->
 						</td>
diff --git a/themes/classic/item.tpl b/themes/classic/item.tpl
index a573ffc1..14a00b93 100644
--- a/themes/classic/item.tpl
+++ b/themes/classic/item.tpl
@@ -79,11 +79,11 @@ $(document).ready(function() {
 <!-- IF B_HASIMAGE -->
 								<td width="10%" valign="top">
 									<table bgcolor="#ffffff">
 										<tr>
 											<td align='center'>
-												<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={PIC_URL}" border="0" align="center"><br>
+												<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={PIC_URL}&auction_id={ID}" border="0" align="center"><br>
 	<!-- IF B_HASGALELRY -->
 												<a href="#gallery"><img src="{SITEURL}images/gallery.gif" border="0" alt="gallery"> {L_694}</a>
 	<!-- ENDIF -->
 											</td>
 										</tr>
@@ -306,11 +306,11 @@ $(document).ready(function() {
 					<table>
 						<tr>
 	<!-- BEGIN gallery -->
 							<td>
 								<a href="{SITEURL}{UPLOADEDPATH}{ID}/{gallery.V}" title="" data-lightbox="gallery">
-									<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={UPLOADEDPATH}{ID}/{gallery.V}" border="0" hspace="10">
+									<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={gallery.V}&auction_id={ID}" border="0" hspace="10">
 								</a>
 							</td>
 	<!-- END gallery -->
 						</tr>
 					</table>
diff --git a/themes/modern/item.tpl b/themes/modern/item.tpl
index 25881532..cceba6f3 100644
--- a/themes/modern/item.tpl
+++ b/themes/modern/item.tpl
@@ -55,20 +55,20 @@ $(document).ready(function() {
 <!-- IF B_HASIMAGE -->
 				<div class="main-gallery panel panel-default">
 					<div class="panel-heading"><span class="label label-default">{L_113}: {ID}</span></div>
 					<div class="panel-body">
 						<div class="col-md-12">
-							<img class="img-rounded img-responsive center-block" src="{SITEURL}getthumb.php?w=430&fromfile={PIC_URL}" border="0" align="center" width="430px">
+							<img class="img-rounded img-responsive center-block" src="{SITEURL}getthumb.php?w=430&fromfile={PIC_URL}&auction_id={ID}" border="0" align="center" width="430px">
 						</div>
 	<!-- IF B_HASGALELRY -->
 						<div>
 							<a name="gallery"></a>
 							<div id="gallery">
 		<!-- BEGIN gallery -->
 								<div class="col-md-4 col-xs-4 col-sm-4">
 									<a href="{SITEURL}{UPLOADEDPATH}{ID}/{gallery.V}" title="" data-lightbox="gallery">
-									<img class="img-rounded img-responsive" src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={UPLOADEDPATH}{ID}/{gallery.V}" border="0"></a>
+									<img class="img-rounded img-responsive" src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={gallery.V}&auction_id={ID}" border="0"></a>
 								</div>
 		<!-- END gallery -->
 							</div>
 						</div>
 	<!-- ENDIF -->
diff --git a/user_login.php b/user_login.php
index ab98569b..8d386c11 100644
--- a/user_login.php
+++ b/user_login.php
@@ -122,11 +122,11 @@ if (isset($_POST['action']) && isset($_POST['username']) && isset($_POST['passwo
     }
 }
 
 $template->assign_vars(array(
         'ERROR' => (isset($ERR)) ? $ERR : '',
-        'USER' => (isset($_POST['username'])) ? $_POST['username'] : ''
+        'USER' => (isset($_POST['username'])) ? $system->cleanvars($_POST['username']) : ''
         ));
 
 include 'header.php';
 $template->set_filenames(array(
         'body' => 'user_login.tpl'
diff --git a/yourauctions.php b/yourauctions.php
index 53f09125..0a3244bc 100644
--- a/yourauctions.php
+++ b/yourauctions.php
@@ -97,12 +97,13 @@ $PAGES = ($TOTALAUCTIONS == 0) ? 1 : ceil($TOTALAUCTIONS / $system->SETTINGS['pe
 // Handle columns sorting variables
 if (!isset($_SESSION['oa_ord']) && empty($_GET['oa_ord'])) {
     $_SESSION['oa_ord'] = 'title';
     $_SESSION['oa_type'] = 'asc';
 } elseif (!empty($_GET['oa_ord'])) {
-    $_SESSION['oa_ord'] = $_GET['oa_ord'];
-    $_SESSION['oa_type'] = $_GET['oa_type'];
+	// check oa_ord && oa_type are valid
+    $_SESSION['oa_ord'] = (in_array($_GET['oa_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['oa_ord'] : 'title';
+    $_SESSION['oa_type'] = (in_array($_GET['oa_type'], array('asc', 'desc'))) ? $_GET['oa_type'] : 'asc';
 } elseif (isset($_SESSION['oa_ord']) && empty($_GET['oa_ord'])) {
     $_SESSION['oa_nexttype'] = $_SESSION['oa_type'];
 }
 if (!isset($_SESSION['oa_nexttype']) || $_SESSION['oa_nexttype'] == 'desc') {
     $_SESSION['oa_nexttype'] = 'asc';
diff --git a/yourauctions_c.php b/yourauctions_c.php
index 3d89e1a3..089bc25d 100644
--- a/yourauctions_c.php
+++ b/yourauctions_c.php
@@ -202,12 +202,13 @@ $PAGES = ($TOTALAUCTIONS == 0) ? 1 : ceil($TOTALAUCTIONS / $system->SETTINGS['pe
 // Handle columns sorting variables
 if (!isset($_SESSION['ca_ord']) && empty($_GET['ca_ord'])) {
     $_SESSION['ca_ord'] = 'title';
     $_SESSION['ca_type'] = 'asc';
 } elseif (!empty($_GET['ca_ord'])) {
-    $_SESSION['ca_ord'] = $_GET['ca_ord'];
-    $_SESSION['ca_type'] = $_GET['ca_type'];
+	// check oa_ord && oa_type are valid
+    $_SESSION['ca_ord'] = (in_array($_GET['ca_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['ca_ord'] : 'title';
+    $_SESSION['ca_type'] = (in_array($_GET['ca_type'], array('asc', 'desc'))) ? $_GET['ca_type'] : 'asc';
 } elseif (isset($_SESSION['ca_ord']) && empty($_GET['ca_ord'])) {
     $_SESSION['ca_nexttype'] = $_SESSION['ca_type'];
 }
 
 if (!isset($_SESSION['ca_nexttype']) || $_SESSION['ca_nexttype'] == 'desc') {
diff --git a/yourauctions_p.php b/yourauctions_p.php
index 761dfa51..e1770eb3 100644
--- a/yourauctions_p.php
+++ b/yourauctions_p.php
@@ -107,12 +107,13 @@ $PAGES = ($TOTALAUCTIONS == 0) ? 1 : ceil($TOTALAUCTIONS / $system->SETTINGS['pe
 // Handle columns sorting variables
 if (!isset($_SESSION['pa_ord']) && empty($_GET['pa_ord'])) {
     $_SESSION['pa_ord'] = 'title';
     $_SESSION['pa_type'] = 'asc';
 } elseif (!empty($_GET['pa_ord'])) {
-    $_SESSION['pa_ord'] = $_GET['pa_ord'];
-    $_SESSION['pa_type'] = $_GET['pa_type'];
+	// check oa_ord && oa_type are valid
+    $_SESSION['pa_ord'] = (in_array($_GET['pa_ord'], array('title', 'starts', 'ends'))) ? $_GET['pa_ord'] : 'title';
+    $_SESSION['pa_type'] = (in_array($_GET['pa_type'], array('asc', 'desc'))) ? $_GET['pa_type'] : 'asc';
 } elseif (isset($_SESSION['pa_ord']) && empty($_GET['pa_ord'])) {
     $_SESSION['pa_nexttype'] = $_SESSION['pa_type'];
 }
 
 if (!isset($_SESSION['pa_nexttype']) || $_SESSION['pa_nexttype'] == 'desc') {
diff --git a/yourauctions_s.php b/yourauctions_s.php
index fa909638..b3343bae 100644
--- a/yourauctions_s.php
+++ b/yourauctions_s.php
@@ -79,12 +79,13 @@ $PAGES = ($TOTALAUCTIONS == 0) ? 1 : ceil($TOTALAUCTIONS / $system->SETTINGS['pe
 // Handle columns sorting variables
 if (!isset($_SESSION['sa_ord']) && empty($_GET['sa_ord'])) {
     $_SESSION['sa_ord'] = 'title';
     $_SESSION['sa_type'] = 'asc';
 } elseif (!empty($_GET['sa_ord'])) {
-    $_SESSION['sa_ord'] = $_GET['sa_ord'];
-    $_SESSION['sa_type'] = $_GET['sa_type'];
+	// check oa_ord && oa_type are valid
+    $_SESSION['sa_ord'] = (in_array($_GET['sa_ord'], array('title', 'num_bids', 'current_bid'))) ? $_GET['sa_ord'] : 'title';
+    $_SESSION['sa_type'] = (in_array($_GET['sa_type'], array('asc', 'desc'))) ? $_GET['sa_type'] : 'asc';
 } elseif (isset($_SESSION['sa_ord']) && empty($_GET['sa_ord'])) {
     $_SESSION['sa_nexttype'] = $_SESSION['sa_type'];
 }
 
 if (!isset($_SESSION['sa_nexttype']) || $_SESSION['sa_nexttype'] == 'desc') {
diff --git a/yourauctions_sold.php b/yourauctions_sold.php
index 578e785d..1cf2a08a 100644
--- a/yourauctions_sold.php
+++ b/yourauctions_sold.php
@@ -147,12 +147,13 @@ $PAGES = ($TOTALAUCTIONS == 0) ? 1 : ceil($TOTALAUCTIONS / $system->SETTINGS['pe
 // Handle columns sorting variables
 if (!isset($_SESSION['solda_ord']) && empty($_GET['solda_ord'])) {
     $_SESSION['solda_ord'] = 'title';
     $_SESSION['solda_type'] = 'asc';
 } elseif (!empty($_GET['solda_ord'])) {
-    $_SESSION['solda_ord'] = $_GET['solda_ord'];
-    $_SESSION['solda_type'] = $_GET['solda_type'];
+	// check oa_ord && oa_type are valid
+    $_SESSION['solda_ord'] = (in_array($_GET['solda_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['solda_ord'] : 'title';
+    $_SESSION['solda_type'] = (in_array($_GET['solda_type'], array('asc', 'desc'))) ? $_GET['solda_type'] : 'asc';
 } elseif (isset($_SESSION['solda_ord']) && empty($_GET['solda_ord'])) {
     $_SESSION['solda_nexttype'] = $_SESSION['solda_type'];
 }
 
 if (!isset($_SESSION['solda_nexttype']) || $_SESSION['solda_nexttype'] == 'desc') {

Vulnerable code:         $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
                    $UPLOADED_PICTURES[] = UPLOAD_FOLDER . $auc_id . '/' . $file;
            'IMAGE' => (!empty($pict_url_plain)) ? '<img src="getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $id . '/' . $pict_url_plain . '" border="0" align="center">' : '&nbsp;',
        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
$_w = $w;
$fromfile = (isset($_GET['fromfile'])) ? $_GET['fromfile'] : '';
// control parameters and file existence
if (!isset($_GET['fromfile']) || $fromfile == '') {
    ErrorPNG($ERR_716);
    exit;
} elseif (!file_exists($_GET['fromfile']) && !fopen($_GET['fromfile'], 'r')) {
    ErrorPNG($ERR_716);
    exit;
}

    $img = getimagesize($fromfile);
        $img = @getimagesize($fromfile);
            load_image($fromfile, $img['mime'], $image_type, $output_type);
            imagecopyresampled($ou, $funcall($fromfile), 0, 0, 0, 0, $w, $h, $img[0], $img[1]);
            $funcall($ou, UPLOAD_PATH . 'cache/' . $_w . '-' . md5($fromfile));
        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_list'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
        if ($minimum_bid >= $row['fee_from'] && $minimum_bid <= $row['fee_to'] && $row['type'] == 'setup') {
            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&amp;fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'] : 'images/email_alerts/default_item_img.jpg',
            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&amp;fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'] : 'images/email_alerts/default_item_img.jpg',
        'PIC_URL' => UPLOAD_FOLDER . $id . '/' . $auction_data['pict_url'],
        'V_YNAME' => (isset($_POST['TPL_name'])) ? $_POST['TPL_name'] : '',
        'V_UNAME' => (isset($_POST['TPL_nick'])) ? $_POST['TPL_nick'] : '',
        'V_EMAIL' => (isset($_POST['TPL_email'])) ? $_POST['TPL_email'] : '',
        'V_YEAR' => (isset($_POST['TPL_year'])) ? $_POST['TPL_year'] : '',
        'V_ADDRE' => (isset($_POST['TPL_address'])) ? $_POST['TPL_address'] : '',
        'V_CITY' => (isset($_POST['TPL_city'])) ? $_POST['TPL_city'] : '',
        'V_PROV' => (isset($_POST['TPL_prov'])) ? $_POST['TPL_prov'] : '',
        'V_POSTCODE' => (isset($_POST['TPL_zip'])) ? $_POST['TPL_zip'] : '',
        'V_PHONE' => (isset($_POST['TPL_phone'])) ? $_POST['TPL_phone'] : ''
									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}" border="0" height="100px">
									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}" border="0" hspace="10">
												<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={PIC_URL}" border="0" align="center"><br>
									<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={UPLOADEDPATH}{ID}/{gallery.V}" border="0" hspace="10">
							<img class="img-rounded img-responsive center-block" src="{SITEURL}getthumb.php?w=430&fromfile={PIC_URL}" border="0" align="center" width="430px">
									<img class="img-rounded img-responsive" src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={UPLOADEDPATH}{ID}/{gallery.V}" border="0"></a>
        'USER' => (isset($_POST['username'])) ? $_POST['username'] : ''
    $_SESSION['oa_ord'] = $_GET['oa_ord'];
    $_SESSION['oa_type'] = $_GET['oa_type'];
    $_SESSION['ca_ord'] = $_GET['ca_ord'];
    $_SESSION['ca_type'] = $_GET['ca_type'];
    $_SESSION['pa_ord'] = $_GET['pa_ord'];
    $_SESSION['pa_type'] = $_GET['pa_type'];
    $_SESSION['sa_ord'] = $_GET['sa_ord'];
    $_SESSION['sa_type'] = $_GET['sa_type'];
    $_SESSION['solda_ord'] = $_GET['solda_ord'];
    $_SESSION['solda_type'] = $_GET['solda_type'];
Fixed code:         $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
                    $UPLOADED_PICTURES[] = $file;
            'IMAGE' => (!empty($pict_url_plain)) ? '<img src="getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $id . '&fromfile=' . $pict_url_plain . '" border="0" align="center">' : '',
        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
// get passed values
$fromfile = $_GET['fromfile'];
$auction_id = $_GET['auction_id'];

// check passed values
if (!isset($_GET['fromfile']) ||
	!isset($_GET['auction_id']) || !is_numeric($auction_id)) {
    ErrorPNG($ERR_716);
    exit;
} elseif (!file_exists($_GET['fromfile']) && !fopen($_GET['fromfile'], 'r')) {
    ErrorPNG($ERR_716);
    exit;
}

if ($fromfile != '') {
	// clean fromfile
	$fromfile = basename($fromfile);
	// build file path
	$file_path = UPLOAD_FOLDER . $auction_id . '/' . $fromfile;
} else {
	// if empty filename just show default image
	$file_path = MAIN_PATH . 'images/email_alerts/default_item_img.jpg';
}

    $img = getimagesize($file_path);
        $img = @getimagesize($file_path);
            load_image($file_path, $img['mime'], $image_type, $output_type);
            imagecopyresampled($ou, $funcall($file_path), 0, 0, 0, 0, $w, $h, $img[0], $img[1]);
            $funcall($ou, UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile));
        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_list'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
        if ($minimum_bid >= $row['fee_from'] && $minimum_bid <= $row['fee_to'] && $row['type'] == 'setup_fee') {
            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'] : '',
            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&amp;fromfile=' . $row['pict_url'] : '',
        'PIC_URL' => $auction_data['pict_url'],
        'V_YNAME' => (isset($_POST['TPL_name'])) ? $system->cleanvars($_POST['TPL_name']) : '',
        'V_UNAME' => (isset($_POST['TPL_nick'])) ? $system->cleanvars($_POST['TPL_nick']) : '',
        'V_EMAIL' => (isset($_POST['TPL_email'])) ? $system->cleanvars($_POST['TPL_email']) : '',
        'V_YEAR' => (isset($_POST['TPL_year'])) ? $system->cleanvars($_POST['TPL_year']) : '',
        'V_ADDRE' => (isset($_POST['TPL_address'])) ? $system->cleanvars($_POST['TPL_address']) : '',
        'V_CITY' => (isset($_POST['TPL_city'])) ? $system->cleanvars($_POST['TPL_city']) : '',
        'V_PROV' => (isset($_POST['TPL_prov'])) ? $system->cleanvars($_POST['TPL_prov']) : '',
        'V_POSTCODE' => (isset($_POST['TPL_zip'])) ? $system->cleanvars($_POST['TPL_zip']) : '',
        'V_PHONE' => (isset($_POST['TPL_phone'])) ? $system->cleanvars($_POST['TPL_phone']) : ''
									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}&auction_id={ID}" border="0" height="100px">
									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}&auction_id={ID}" border="0" hspace="10">
												<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={PIC_URL}&auction_id={ID}" border="0" align="center"><br>
									<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={gallery.V}&auction_id={ID}" border="0" hspace="10">
							<img class="img-rounded img-responsive center-block" src="{SITEURL}getthumb.php?w=430&fromfile={PIC_URL}&auction_id={ID}" border="0" align="center" width="430px">
									<img class="img-rounded img-responsive" src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={gallery.V}&auction_id={ID}" border="0"></a>
        'USER' => (isset($_POST['username'])) ? $system->cleanvars($_POST['username']) : ''
	// check oa_ord && oa_type are valid
    $_SESSION['oa_ord'] = (in_array($_GET['oa_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['oa_ord'] : 'title';
    $_SESSION['oa_type'] = (in_array($_GET['oa_type'], array('asc', 'desc'))) ? $_GET['oa_type'] : 'asc';
	// check oa_ord && oa_type are valid
    $_SESSION['ca_ord'] = (in_array($_GET['ca_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['ca_ord'] : 'title';
    $_SESSION['ca_type'] = (in_array($_GET['ca_type'], array('asc', 'desc'))) ? $_GET['ca_type'] : 'asc';
	// check oa_ord && oa_type are valid
    $_SESSION['pa_ord'] = (in_array($_GET['pa_ord'], array('title', 'starts', 'ends'))) ? $_GET['pa_ord'] : 'title';
    $_SESSION['pa_type'] = (in_array($_GET['pa_type'], array('asc', 'desc'))) ? $_GET['pa_type'] : 'asc';
	// check oa_ord && oa_type are valid
    $_SESSION['sa_ord'] = (in_array($_GET['sa_ord'], array('title', 'num_bids', 'current_bid'))) ? $_GET['sa_ord'] : 'title';
    $_SESSION['sa_type'] = (in_array($_GET['sa_type'], array('asc', 'desc'))) ? $_GET['sa_type'] : 'asc';
	// check oa_ord && oa_type are valid
    $_SESSION['solda_ord'] = (in_array($_GET['solda_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['solda_ord'] : 'title';
    $_SESSION['solda_type'] = (in_array($_GET['solda_type'], array('asc', 'desc'))) ? $_GET['solda_type'] : 'asc';