CVE-2014-125077: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability, which was classified as critical, has been found in pointhi searx_stats. This issue affects some unknown processing of the file cgi/cron.php. The manipulation leads to sql injection. The patch is named 281bd679a4474ddb222d16c1c380f252839cc18f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218351.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-15T09:15Z
Repository: https://github.com/pointhi/searx_stats
Language: PHP
Files changed: cgi/cron.php
Commit date: 2014-12-19 11:53:34 +0100
Commit message: [enh] add SQL-Injection protection

Diff: diff --git a/cgi/cron.php b/cgi/cron.php
index 345729d..de8bbc5 100644
--- a/cgi/cron.php
+++ b/cgi/cron.php
@@ -92,14 +92,14 @@ if((bool)$config["instances"]["cronjob"] == True) {
             }
         }
         
         // save in database
         $query = "UPDATE `#instances` SET ".
-            "`VERSION_STRING` = '".$res_searx_version."', ".
-            "`RETURN_CODE` = '".$res_http_code."', ".
+            "`VERSION_STRING` = '".DatabaseManager::correctString($res_searx_version)."', ".
+            "`RETURN_CODE` = '".(int)$res_http_code."', ".
             "`LAST_UPDATE` = '".date('Y-m-d H:i:s',$res_timestamp)."' ".
-            "WHERE `#instances`.`ID` =".$single_instance['id'].";";
+            "WHERE `#instances`.`ID` =".(int)$single_instance['id'].";";
         $DatabaseHandler->query($query);
 
         // print result
         if($res_http_code >= 200 && $res_http_code < 300)
             echo ' - HTTP-CODE: '.$res_http_code;
@@ -172,11 +172,11 @@ if((bool)$config["engines"]["cronjob"] == True && $config["engines"]["server"] !
         
         // save in database
         $query = "UPDATE `#engines` SET ".
             "`IS_WORKING` = '".(int)$res_success."', ".
             "`LAST_UPDATE` = '".date('Y-m-d H:i:s',$res_timestamp)."' ".
-            "WHERE `#engines`.`ID` =".$single_engine['id'].";";
+            "WHERE `#engines`.`ID` =".(int)$single_engine['id'].";";
         $DatabaseHandler->query($query);
         
         if($res_success)
             echo ' - SUCCESS<br/>';
         else

Vulnerable code:             "`VERSION_STRING` = '".$res_searx_version."', ".
            "`RETURN_CODE` = '".$res_http_code."', ".
            "WHERE `#instances`.`ID` =".$single_instance['id'].";";
            "WHERE `#engines`.`ID` =".$single_engine['id'].";";
Fixed code:             "`VERSION_STRING` = '".DatabaseManager::correctString($res_searx_version)."', ".
            "`RETURN_CODE` = '".(int)$res_http_code."', ".
            "WHERE `#instances`.`ID` =".(int)$single_instance['id'].";";
            "WHERE `#engines`.`ID` =".(int)$single_engine['id'].";";