CVE-2016-9183: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class mysqli_database uses the injectProof method to prevent SQL injection, but this filter can be bypassed easily: it only sanitizes user input if there are odd numbers of ' or " characters. Impact is Information Disclosure.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2016-11-04T10:59Z
Repository: https://github.com/exponentcms/exponent-cms
Language: PHP
Files changed: framework/modules/core/controllers/expHTMLEditorController.php, framework/modules/ecommerce/controllers/orderController.php
Commit date: 2016-11-03 10:35:09 -0400
Commit message: fix security vulnerability in order search and editor preview; reported by fyth

Diff: diff --git a/framework/modules/core/controllers/expHTMLEditorController.php b/framework/modules/core/controllers/expHTMLEditorController.php
index 392e3027c2f..0b347b925bb 100644
--- a/framework/modules/core/controllers/expHTMLEditorController.php
+++ b/framework/modules/core/controllers/expHTMLEditorController.php
@@ -169,11 +169,11 @@ class expHTMLEditorController extends expController
                 $demo->skin = 'kama';
             } elseif ($this->params['editor'] == 'tinymce') {
                 $demo->skin = 'lightgray';
             }
         } else {
-            $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);
+            $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));
         }
         assign_to_template(
             array(
                 'demo' => $demo,
                 'editor' => $this->params['editor']
diff --git a/framework/modules/ecommerce/controllers/orderController.php b/framework/modules/ecommerce/controllers/orderController.php
index c544927dd94..2924c463c79 100755
--- a/framework/modules/ecommerce/controllers/orderController.php
+++ b/framework/modules/ecommerce/controllers/orderController.php
@@ -2131,10 +2131,11 @@ exit();
      */
     public function search() {
 //        global $db, $user;
         global $db;
 
+        $this->params['query'] = expString::escape($this->params['query']);
         $sql = "select DISTINCT(a.id) as id, a.firstname as firstname, a.middlename as middlename, a.lastname as lastname, a.organization as organization, a.email as email ";
         $sql .= "from " . $db->prefix . "addresses as a "; //R JOIN " .
         //$db->prefix . "billingmethods as bm ON bm.addresses_id=a.id ";
         $sql .= " WHERE match (a.firstname,a.lastname,a.email,a.organization) against ('" . $this->params['query'] .
             "*' IN BOOLEAN MODE) ";
@@ -2154,10 +2155,11 @@ exit();
      */
     public function search_external() {
 //        global $db, $user;
         global $db;
 
+        $this->params['query'] = expString::escape($this->params['query']);
         $sql = "select DISTINCT(a.id) as id, a.source as source, a.firstname as firstname, a.middlename as middlename, a.lastname as lastname, a.organization as organization, a.email as email ";
         $sql .= "from " . $db->prefix . "external_addresses as a "; //R JOIN " .
         //$db->prefix . "billingmethods as bm ON bm.addresses_id=a.id ";
         $sql .= " WHERE match (a.firstname,a.lastname,a.email,a.organization) against ('" . $this->params['query'] .
             "*' IN BOOLEAN MODE) ";

Vulnerable code:             $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);
Fixed code:             $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));
        $this->params['query'] = expString::escape($this->params['query']);
        $this->params['query'] = expString::escape($this->params['query']);