CVE-2007-10001: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability classified as problematic has been found in web-cyradm. This affects an unknown part of the file search.php. The manipulation of the argument searchstring leads to sql injection. It is recommended to apply a patch to fix this issue. The identifier VDB-217449 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.5
Published: 2023-01-05T12:15Z
Repository: https://github.com/web-cyradm/web-cyradm
Language: PHP
Files changed: search.php
Commit date: 2007-07-01 07:53:16 +0000
Commit message: Fixed information disclosure by SQL injection


Diff: diff --git a/search.php b/search.php
index 4f87508..fd3fbb3 100644
--- a/search.php
+++ b/search.php
@@ -32,11 +32,11 @@ if ($authorized) {
 		}
 	}
 
 
 	#####  Show matching Domains first #######
-	$query = "SELECT * FROM domain AS a WHERE domain_name LIKE '%".$_GET['searchstring']."%' AND ".$allowed_domains1."') ORDER BY domain_name";
+	$query = "SELECT * FROM domain AS a WHERE domain_name LIKE '%".addslashes($_GET['searchstring'])."%' AND ".$allowed_domains1."') ORDER BY domain_name";
 	$result = $handle->query($query);
 	$cnt = $result->numRows();
 
 	print "<tr>";
 	print "<td width=\"10\">&nbsp; </td>";
@@ -103,19 +103,19 @@ if ($authorized) {
 	}
 	print "</tbody>";
 	print "</table>";
 
 	############ And now show the users matching the search query ###########
-	$query = "SELECT DISTINCT a.username, a.domain_name FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".$_GET['searchstring']."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
+	$query = "SELECT DISTINCT a.username, a.domain_name FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".addslashes($_GET['searchstring'])."%') OR (v.alias LIKE '%".addslashes($_GET['searchstring'])."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
 	$result = $handle->query($query);
 	$total = $result->numRows();
 
 	print "<h3>"._("Total users matching").": ".$total."</h3>";
 	if (empty($row_pos)) {
 		$row_pos = 0;
 	}
-        $query = "SELECT DISTINCT a.* FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".$_GET['searchstring']."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
+        $query = "SELECT DISTINCT a.* FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".addslashes($_GET['searchstring'])."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
 	$result = $handle->limitQuery($query,$row_pos,10);
 	$cnt = $result->numRows();
 
 	print "<h4>"._("Displaying from position").": ".$row_pos."</h4>";
 	if ($cnt!=0) {

Vulnerable code: 	$query = "SELECT * FROM domain AS a WHERE domain_name LIKE '%".$_GET['searchstring']."%' AND ".$allowed_domains1."') ORDER BY domain_name";
	$query = "SELECT DISTINCT a.username, a.domain_name FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".$_GET['searchstring']."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
        $query = "SELECT DISTINCT a.* FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".$_GET['searchstring']."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
Fixed code: 	$query = "SELECT * FROM domain AS a WHERE domain_name LIKE '%".addslashes($_GET['searchstring'])."%' AND ".$allowed_domains1."') ORDER BY domain_name";
	$query = "SELECT DISTINCT a.username, a.domain_name FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".addslashes($_GET['searchstring'])."%') OR (v.alias LIKE '%".addslashes($_GET['searchstring'])."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";
        $query = "SELECT DISTINCT a.* FROM virtual as v, accountuser as a WHERE ((v.username LIKE '%".$_GET['searchstring']."%') OR (v.alias LIKE '%".addslashes($_GET['searchstring'])."%')) AND (v.username=a.username) AND ".$allowed_domains1."') ORDER BY username";