CVE-2023-31714: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-08-30T22:15Z
Repository: https://github.com/waqaskanju/Chitor-CMS
Language: PHP
Files changed: edit_school.php, edit_school_class.php, functions.php, new_code_test.php, sand_box.php, scripts/check_roll_no.php, scripts/update_subject_marks.php
Commit date: 2023-04-16 23:57:21 +0500
Commit message: add real_escape_string function to sandbox validate file

Diff: diff --git a/edit_school.php b/edit_school.php
index f4df818..64bb675 100644
--- a/edit_school.php
+++ b/edit_school.php
@@ -15,11 +15,11 @@
  **/
 session_start();
 require_once 'sand_box.php';
 $link=$LINK;
 
-if ($SCHOOL_CHANGES=="0") {
+if ($SCHOOL_CHANGES!=1) {
     echo '<div class="bg-danger text-center"> Not allowed!! </div>';
     exit;
 }
 
 /* Rules for Naming add under score between two words. */
diff --git a/edit_school_class.php b/edit_school_class.php
index a48e793..82076ba 100644
--- a/edit_school_class.php
+++ b/edit_school_class.php
@@ -17,11 +17,11 @@ session_start();
 require_once 'sand_box.php';
 $link=$LINK;
 $selected_class=$CLASS_NAME;
 $selected_school=$SCHOOL_NAME;
 
-if ($SCHOOL_CHANGES=="0") {
+if ($SCHOOL_CHANGES!=1) {
     echo '<div class="bg-danger text-center"> Not allowed!! </div>';
     exit;
 }
 
 /* Rules for Naming add under score between two words. */
diff --git a/functions.php b/functions.php
index ccb3b34..1da61f7 100644
--- a/functions.php
+++ b/functions.php
@@ -186,24 +186,10 @@ function Change_Status_To_word($status)
 function redirection($sec,$url) 
 {
     header("refresh:$sec; url=$url");
 }
 
-/**
- * Validate Form Input;
- *
- * @param string $data Name of the class.
- *
- * @return string return clean data.
- */
-function Validate_input($data)
-{
-    $data = trim($data);
-    $data = stripslashes($data);
-    $data = htmlspecialchars($data);
-    return $data;
-}
 
 /**
  * Show Alert Message
  * 
  * @param string $message    Time in Second
diff --git a/new_code_test.php b/new_code_test.php
index c7dc136..7b06f0a 100644
--- a/new_code_test.php
+++ b/new_code_test.php
@@ -14,6 +14,15 @@
      * @link http://www.waqaskanju.com/
      **/
 
 require_once 'sand_box.php';
 $link=$LINK;
+
+
+
+echo $query = 'SELECT Name,Class FROM students_info WHERE Name=? AND Class=?';
+$result = mysqli_execute_query($link, $query, ['Abdullah','5th']);
+foreach ($result as $row) {
+    printf($row["Name"]. $row['Class']);
+    echo "<br>";
+}
 ?>
diff --git a/sand_box.php b/sand_box.php
index 03ebb84..41e1d4e 100644
--- a/sand_box.php
+++ b/sand_box.php
@@ -902,8 +902,27 @@ function Exam_footer($class,$fail,$pass,$total)
             ";
       echo   "</div>
     </div>
     ";
 }
+
+
+/**
+ * Validate Form Input;
+ *
+ * @param string $data Name of the class.
+ *
+ * @return string return clean data.
+ */
+function Validate_input($data)
+{
+    
+    global $link;
+    $data = trim($data);
+    $data = stripslashes($data);
+    $data = htmlspecialchars($data);
+    mysqli_real_escape_string($link, $data);
+    return $data;
+}
 ?>
 
 
diff --git a/scripts/check_roll_no.php b/scripts/check_roll_no.php
index b5e4d5c..f0aac8a 100644
--- a/scripts/check_roll_no.php
+++ b/scripts/check_roll_no.php
@@ -12,11 +12,11 @@
  *
  * @link None
  **/
 session_start();
 require_once '../db_connection.php';
-require_once '../functions.php';
+require_once '../sand_box.php';
 $link=$LINK;
 
 
 if (isset($_GET['roll_no'])) {
     $roll_no=$_GET['roll_no'];
diff --git a/scripts/update_subject_marks.php b/scripts/update_subject_marks.php
index 542f23d..a70b683 100644
--- a/scripts/update_subject_marks.php
+++ b/scripts/update_subject_marks.php
@@ -39,11 +39,11 @@ if ($marks>100) {
     echo "Max Marks error";
     exit;
 }
 $q="UPDATE marks SET $subject = $marks WHERE Roll_No=$roll_no";
 // Do this if lock=off, that means lock=0
-// Singel Marks changes=allow means 1.
+// Single Marks changes=allow means 1.
 if ($SINGLE_MARKS_CHANGES==1 && $update_Status==0) {
     $exe=mysqli_query($link, $q) or die('error'.mysqli_error($link));
     if ($exe) {
         echo "<span class='alert alert-success' role='alert'> Marks Saved.
                 </span>";

Vulnerable code: if ($SCHOOL_CHANGES=="0") {
if ($SCHOOL_CHANGES=="0") {
/**
 * Validate Form Input;
 *
 * @param string $data Name of the class.
 *
 * @return string return clean data.
 */
function Validate_input($data)
{
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    return $data;
}
require_once '../functions.php';
// Singel Marks changes=allow means 1.
Fixed code: if ($SCHOOL_CHANGES!=1) {
if ($SCHOOL_CHANGES!=1) {



echo $query = 'SELECT Name,Class FROM students_info WHERE Name=? AND Class=?';
$result = mysqli_execute_query($link, $query, ['Abdullah','5th']);
foreach ($result as $row) {
    printf($row["Name"]. $row['Class']);
    echo "<br>";
}


/**
 * Validate Form Input;
 *
 * @param string $data Name of the class.
 *
 * @return string return clean data.
 */
function Validate_input($data)
{
    
    global $link;
    $data = trim($data);
    $data = stripslashes($data);
    $data = htmlspecialchars($data);
    mysqli_real_escape_string($link, $data);
    return $data;
}
require_once '../sand_box.php';
// Single Marks changes=allow means 1.