CVE-2017-5609: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in include/functions_entries.inc.php in Serendipity 2.0.5 allows remote authenticated users to execute arbitrary SQL commands via the cat parameter.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2017-01-28T18:59Z
Repository: https://github.com/s9y/Serendipity
Language: Other
Files changed: docs/NEWS, include/functions_entries.inc.php
Commit date: 2017-01-16 11:29:15 +0100
Commit message: * [Security] Fix missing integer casting for inserting new categories
    (thanks to cdxy)

Diff: diff --git a/docs/NEWS b/docs/NEWS
index 1cba2d217..cd799fe0a 100644
--- a/docs/NEWS
+++ b/docs/NEWS
@@ -18,10 +18,13 @@ Version 2.1 ()
     * [Security] Reject %0D/%0A in exit tracking and other places
       (Issue #434)
       
     * [Security] Redirection of comment.php now checks the referrer
       and only allows the blog's host (thanks to Lee Sheldon Victor)
+      
+    * [Security] Fix missing integer casting for inserting new categories
+      (thanks to cdxy)
 
     * Disabled Selenium test files unless enabled
 
 Version 2.1-beta2 (September 26th, 2016)
 ------------------------------------------------------------------------
diff --git a/include/functions_entries.inc.php b/include/functions_entries.inc.php
index 45453c804..59bdf81a3 100644
--- a/include/functions_entries.inc.php
+++ b/include/functions_entries.inc.php
@@ -1521,11 +1521,11 @@ function serendipity_updertEntry($entry) {
         }
 
         if (is_array($categories)) {
             serendipity_db_query("DELETE FROM {$serendipity['dbPrefix']}entrycat WHERE entryid={$entry['id']}");
             foreach ($categories as $cat) {
-                serendipity_db_query("INSERT INTO {$serendipity['dbPrefix']}entrycat (entryid, categoryid) VALUES ({$entry['id']}, {$cat})");
+                serendipity_db_query("INSERT INTO {$serendipity['dbPrefix']}entrycat (entryid, categoryid) VALUES ({$entry['id']}, " . (int)$cat . ")");
             }
         } elseif ($had_categories) {
             // This case actually only happens if an existing entry is edited, and its category assignments are all removed.
             // This field is set as a HIDDEN input field in the admin/entries.tpl template.
             // This is more of a hotfix. In the future it should be thoroughly checked whether calls to serendipity_updertEntry()

Vulnerable code:                 serendipity_db_query("INSERT INTO {$serendipity['dbPrefix']}entrycat (entryid, categoryid) VALUES ({$entry['id']}, {$cat})");
Fixed code:       
    * [Security] Fix missing integer casting for inserting new categories
      (thanks to cdxy)
                serendipity_db_query("INSERT INTO {$serendipity['dbPrefix']}entrycat (entryid, categoryid) VALUES ({$entry['id']}, " . (int)$cat . ")");