CVE-2023-32308: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for errors before adjusting invoice sorting order. Because of this, it was possible to craft a POST request with malicious SQL for Time Tracker database. This issue has been fixed in version 1.22.11.5781. Users are advised to upgrade. Users unable to upgrade may insert an additional check for errors in a condition before calling `ttGroupHelper::getActiveInvoices()` in invoices.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-05-15T21:15Z
Repository: https://github.com/anuko/timetracker
Language: PHP
Files changed: initialize.php, invoices.php
Commit date: 2023-05-05 14:43:41 +0000
Commit message: Addressed an sql vulnerability in invoices.php for bogus post parameters for sorting.

Diff: diff --git a/initialize.php b/initialize.php
index 93345f37b..f8cb044a3 100644
--- a/initialize.php
+++ b/initialize.php
@@ -19,11 +19,11 @@ if (version_compare(phpversion(), '8.1', '>=')) {
     mysqli_report(MYSQLI_REPORT_OFF);
   else
     die("mysqli_report function is not available."); // No point to continue as mysqli will not work.
 }
 
-define("APP_VERSION", "1.22.11.5780");
+define("APP_VERSION", "1.22.11.5781");
 define("APP_DIR", dirname(__FILE__));
 define("LIBRARY_DIR", APP_DIR."/WEB-INF/lib");
 define("TEMPLATE_DIR", APP_DIR."/WEB-INF/templates");
 // Date format for database and URI parameters.
 define('DB_DATEFORMAT', '%Y-%m-%d');
diff --git a/invoices.php b/invoices.php
index 3f6438b96..f1eda4849 100644
--- a/invoices.php
+++ b/invoices.php
@@ -74,11 +74,11 @@ if ($request->isPost()) {
   if (!ttInvoiceHelper::validSortOption($sort_option_2, true)) $err->add($i18n->get('error.field'),  $i18n->get('label.sort'));
   if (!ttInvoiceHelper::validSortOrder($sort_order_1)) $err->add($i18n->get('error.field'),  $i18n->get('label.sort'));
   if (!ttInvoiceHelper::validSortOrder($sort_order_2)) $err->add($i18n->get('error.field'),  $i18n->get('label.sort'));
   if ($sort_option_1 == $sort_option_2) $err->add($i18n->get('error.field'),  $i18n->get('label.sort'));
 
-  if($request->getParameter('sorting_changed')) {
+  if($err->no() && $request->getParameter('sorting_changed')) {
     // User changed sorting. Get invoices sorted accordingly.
     $sort_options = array('sort_option_1'=>$sort_option_1,
       'sort_order_1'=>$sort_order_1,
       'sort_option_2'=>$sort_option_2,
       'sort_order_2'=>$sort_order_2);

Vulnerable code: define("APP_VERSION", "1.22.11.5780");
  if($request->getParameter('sorting_changed')) {
Fixed code: define("APP_VERSION", "1.22.11.5781");
  if($err->no() && $request->getParameter('sorting_changed')) {