CVE-2013-10011: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in aeharding classroom-engagement-system and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to sql injection. The attack may be launched remotely. The name of the patch is 096de5815c7b414e7339f3439522a446098fb73a. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218156.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-12T16:15Z
Repository: https://github.com/aeharding/classroom-engagement-system
Language: PHP
Files changed: webserver/student/index.php, webserver/teacher/create.php, webserver/teacher/email/welcome.php, webserver/teacher/login.php
Commit date: 2013-03-21 04:35:50 +0000
Commit message: real_escape_string() to prevent SQL injections on database.
 Removed old welcomeEmail.php
Diff: diff --git a/webserver/img/Thumbs.db b/webserver/img/Thumbs.db
index dcb0e17..a25b6a5 100644
Binary files a/webserver/img/Thumbs.db and b/webserver/img/Thumbs.db differ
diff --git a/webserver/student/index.php b/webserver/student/index.php
index 1c41186..d02fdf9 100644
--- a/webserver/student/index.php
+++ b/webserver/student/index.php
@@ -12,17 +12,24 @@
 		$student = $_POST['student'];
 		
 		$error = false;
 		$errorMsg = '';
 		
+		
 		if(strlen($student) > 4) {
+		
+			// Prevent SQL Injections
+			$session = $con->real_escape_string($session);
+			$student = $con->real_escape_string($student);
+			
 			$sql="SELECT count(1) FROM sessions WHERE s_sid='" . $session . "'";
 
 			if (!mysqli_query($con,$sql)) {
 				die('Error: ' . mysqli_error());
 			}
-			
+
+
 			$result = $con->query($sql);
 			$row = $result->fetch_array(MYSQLI_NUM);
 			$total = $row[0];
 			if($total == 1) {
 				$sql="SELECT count(1) FROM sessions WHERE s_sid='" . $session . "' AND s_isOpen='1'";
diff --git a/webserver/teacher/create.php b/webserver/teacher/create.php
index 158832d..1702ece 100644
--- a/webserver/teacher/create.php
+++ b/webserver/teacher/create.php
@@ -1,9 +1,9 @@
 <?php
 	
 function checkID($con,$id_check) {
-	$id_check = $con->real_escape_string($id_check);
+	$id_check = $con->real_escape_string($id_check); // Prevent SQL Injections
 	$query = "SELECT * FROM sessions WHERE s_sid='" . $id_check . "'";
 	$result = $con->query($query);
 	if(count($result->fetch_array(MYSQLI_NUM)) > 0) {
 		return false;
 	}
diff --git a/webserver/teacher/email/welcome.php b/webserver/teacher/email/welcome.php
index 2ef2ac0..f5a437f 100644
--- a/webserver/teacher/email/welcome.php
+++ b/webserver/teacher/email/welcome.php
@@ -1,7 +1,7 @@
 <?php
-	/* ONLY USED BY CREATE.PHP, expects:
+	/* ONLY USED BY ../CREATE.PHP, expects:
 			1. $email: Email of user
 			2. $id:		 Class session name
 			3. $pass:  Specified password for $id
 	*/
 	
diff --git a/webserver/teacher/login.php b/webserver/teacher/login.php
index af917a9..de97059 100644
--- a/webserver/teacher/login.php
+++ b/webserver/teacher/login.php
@@ -13,10 +13,15 @@
 				exit();
 		}
 		
 		$session = $_POST['sid'];
 		$pass = $_POST['pass'];
+		
+		// Prevent SQL Injections
+		$session = $con->real_escape_string($session);
+		$pass = $con->real_escape_string($pass);
+
 
 		$sql="SELECT count(1) FROM sessions WHERE s_sid='" . $session . "' AND s_pass='" . $pass . "'";
 
 		if (!mysqli_query($con,$sql)) {
 			die('Error: ' . mysqli_error());
diff --git a/webserver/teacher/welcomeEmail.php b/webserver/teacher/welcomeEmail.php
deleted file mode 100644
index 84734e2..0000000
--- a/webserver/teacher/welcomeEmail.php
+++ /dev/null
@@ -1,17 +0,0 @@
-<?php
-	// Biiiggg TODO
-	include '../setup/connect.php';
-	$con = new mysqli($config_server, $config_user, $config_pass, $config_table);
-	$sql="SELECT count(1) FROM sessions WHERE s_sid='" . $session . "' AND s_pass='" . $pass . "'";
-	if (!mysqli_query($con,$sql)) {
-		die('Error: ' . mysqli_error());
-	}
-	
-	$result=$con->query($sql);
-	$row = $result->fetch_array(MYSQLI_NUM);
-	$total = $row[0];
-	if($total == 1) {
-	}
-
-
-?>
\ No newline at end of file

Vulnerable code: 			
	$id_check = $con->real_escape_string($id_check);
	/* ONLY USED BY CREATE.PHP, expects:
<?php
	// Biiiggg TODO
	include '../setup/connect.php';
	$con = new mysqli($config_server, $config_user, $config_pass, $config_table);
	$sql="SELECT count(1) FROM sessions WHERE s_sid='" . $session . "' AND s_pass='" . $pass . "'";
	if (!mysqli_query($con,$sql)) {
		die('Error: ' . mysqli_error());
	}
	
	$result=$con->query($sql);
	$row = $result->fetch_array(MYSQLI_NUM);
	$total = $row[0];
	if($total == 1) {
	}


?>
Fixed code: 		
		
			// Prevent SQL Injections
			$session = $con->real_escape_string($session);
			$student = $con->real_escape_string($student);
			


	$id_check = $con->real_escape_string($id_check); // Prevent SQL Injections
	/* ONLY USED BY ../CREATE.PHP, expects:
		
		// Prevent SQL Injections
		$session = $con->real_escape_string($session);
		$pass = $con->real_escape_string($pass);