CVE-2013-10018: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in fanzila WebFinance 0.5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file htdocs/prospection/save_contact.php. The manipulation of the argument nom/prenom/email/tel/mobile/client/fonction/note leads to sql injection. The identifier of the patch is 165dfcaa0520ee0179b7c1282efb84f5a03df114. It is recommended to apply a patch to fix this issue. The identifier VDB-220057 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-02-04T00:15Z
Repository: https://github.com/fanzila/WebFinance
Language: PHP
Files changed: htdocs/prospection/save_contact.php
Commit date: 2013-04-12 17:45:04 +0200
Commit message: * htdocs/prospection/save_contact.php: fixed SQL injection, yet again

Diff: diff --git a/htdocs/prospection/save_contact.php b/htdocs/prospection/save_contact.php
index 28a7100..940ebf7 100644
--- a/htdocs/prospection/save_contact.php
+++ b/htdocs/prospection/save_contact.php
@@ -37,18 +37,18 @@ must_login();
 if ($_POST['action'] == "create") {
 
   $_SESSION['tmp_message'] = $_SESSION['message'];
 
   $q = sprintf("INSERT INTO webfinance_personne (nom,prenom,email,tel,mobile,client,fonction,date_created,note) VALUES ('%s', '%s', '%s', '%s', '%s', %d, '%s', now(),'%s')",
-       $_POST['nom'],
-       $_POST['prenom'],
-       $_POST['email'],
-       removeSpace($_POST['tel']),
-       removeSpace($_POST['mobile']),
-       $_POST['client'],
-       $_POST['fonction'],
-       $_POST['note'] );
+       mysql_real_escape_string($_POST['nom']),
+       mysql_real_escape_string($_POST['prenom']),
+       mysql_real_escape_string($_POST['email']),
+       mysql_real_escape_string(removeSpace($_POST['tel'])),
+       mysql_real_escape_string(removeSpace($_POST['mobile'])),
+       mysql_real_escape_string($_POST['client']),
+       mysql_real_escape_string($_POST['fonction']),
+       mysql_real_escape_string($_POST['note'] ));
 
   mysql_query($q)
     or die("QUERY ERROR: $q ".mysql_error());
 
   $_SESSION['message'] = _("Contact added");

Vulnerable code:        $_POST['nom'],
       $_POST['prenom'],
       $_POST['email'],
       removeSpace($_POST['tel']),
       removeSpace($_POST['mobile']),
       $_POST['client'],
       $_POST['fonction'],
       $_POST['note'] );
Fixed code:        mysql_real_escape_string($_POST['nom']),
       mysql_real_escape_string($_POST['prenom']),
       mysql_real_escape_string($_POST['email']),
       mysql_real_escape_string(removeSpace($_POST['tel'])),
       mysql_real_escape_string(removeSpace($_POST['mobile'])),
       mysql_real_escape_string($_POST['client']),
       mysql_real_escape_string($_POST['fonction']),
       mysql_real_escape_string($_POST['note'] ));