CVE-2014-125032: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in porpeeranut go-with-me. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file module/frontend/add.php. The manipulation leads to sql injection. The identifier of the patch is b92451e4f9e85e26cf493c95ea0a69e354c35df9. It is recommended to apply a patch to fix this issue. The identifier VDB-217177 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-02T08:15Z
Repository: https://github.com/porpeeranut/go-with-me
Language: PHP
Files changed: module/frontend/add.php
Commit date: 2014-12-08 13:40:29 +0700
Commit message: Fix sql injection in add.php file

Diff: diff --git a/module/frontend/add.php b/module/frontend/add.php
index 35e589a..de505a7 100644
--- a/module/frontend/add.php
+++ b/module/frontend/add.php
@@ -59,14 +59,14 @@ if ($table_name=="REGISTER") {
     }
   }
 }
 else if ($table_name=="PHOTO") {
   $caotion = clean($_POST["caption"]);
-  $owner = $m_id;
-  $loc_id = $_POST["loc_id"];
-  $timing_id = $_POST["timing_id"];
-  $pos_id = $_POST["pos_id"];
+  $owner = intval($m_id);
+  $loc_id = intval($_POST["loc_id"]);
+  $timing_id = intval($_POST["timing_id"]);
+  $pos_id = intval($_POST["pos_id"]);
 
   $sql = "insert into PHOTO values (member_seq.nextval, '$caption', $owner, $loc_id, $timing_id, $pos_id, systimestamp)";
   $stid = oci_parse($db_conn, $sql);
   $r = oci_execute($stid);
 
@@ -126,12 +126,12 @@ else if ($table_name=="PHOTO") {
     $result["status"] = "failed";
     $result["data"] = $e["message"];
   }
 }
 else if ($table_name=="COMMENT") {
-  $msg = $_POST["msg"];
-  $p_id = $_POST["p_id"];
+  $msg = clean($_POST["msg"]);
+  $p_id = intval($_POST["p_id"]);
 
   $sql = "insert into COMMENT_PHOTO values (comment_photo_seq.nextval, $m_id, $p_id, '$msg', systimestamp)";
   $stid = oci_parse($db_conn, $sql);
   $r = oci_execute($stid);
   if ($r) {
@@ -142,11 +142,11 @@ else if ($table_name=="COMMENT") {
     $result["status"] = "failed";
     $result["data"] = $e["message"];
   }
 }
 else if ($table_name=="LIKE") {
-  $p_id = $_POST["p_id"];
+  $p_id = intval($_POST["p_id"]);
   $sql = "insert into LIKE_PHOTO values ($m_id, $p_id, systimestamp)";
   $stid = oci_parse($db_conn, $sql);
   $r = oci_execute($stid);
   if ($r) {
     $result["status"] = "success";
@@ -156,12 +156,12 @@ else if ($table_name=="LIKE") {
     $result["status"] = "failed";
     $result["data"] = $e["message"];
   }
 }
 else if ($table_name=="MESSAGE") {
-  $to = $_POST["to"];
-  $msg = $_POST["msg"];
+  $to = intval($_POST["to"]);
+  $msg = clean($_POST["msg"]);
   $sql = "insert into MESSAGE values (message.nextval, $m_id, $to, msg, systimestamp)";
   $stid = oci_parse($db_conn, $sql);
   $r = oci_execute($stid);
   if ($r) {
     $sql = "update MEMBER set IS_UNREAD='t' where ID=$to";

Vulnerable code:   $owner = $m_id;
  $loc_id = $_POST["loc_id"];
  $timing_id = $_POST["timing_id"];
  $pos_id = $_POST["pos_id"];
  $msg = $_POST["msg"];
  $p_id = $_POST["p_id"];
  $p_id = $_POST["p_id"];
  $to = $_POST["to"];
  $msg = $_POST["msg"];
Fixed code:   $owner = intval($m_id);
  $loc_id = intval($_POST["loc_id"]);
  $timing_id = intval($_POST["timing_id"]);
  $pos_id = intval($_POST["pos_id"]);
  $msg = clean($_POST["msg"]);
  $p_id = intval($_POST["p_id"]);
  $p_id = intval($_POST["p_id"]);
  $to = intval($_POST["to"]);
  $msg = clean($_POST["msg"]);