CVE-2018-1000867: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Database Read via Blind SQL Injection. This attack appear to be exploitable via HTTP Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2018-12-20T17:29Z
Repository: https://github.com/renlok/WeBid
Language: PHP
Files changed: active_auctions.php, admin/editauction.php, bid.php, closed_auctions.php, getthumb.php, includes/browseitems.inc.php, includes/functions_sell.php, index.php, item.php, register.php, themes/adminClassic/editauction.tpl, themes/adminModern/editauction.tpl, themes/classic/item.tpl, themes/modern/item.tpl, user_login.php, yourauctions.php, yourauctions_c.php, yourauctions_p.php, yourauctions_s.php, yourauctions_sold.php
Commit date: 2018-11-22 01:36:55 +0000
Commit message: Number of secerity fixes & fix for setup fee #510

Diff: diff --git a/active_auctions.php b/active_auctions.php
index e90c9a4d..2caadddd 100644
--- a/active_auctions.php
+++ b/active_auctions.php
@@ -64,11 +64,11 @@ $params[] = array(':perpage', $system->SETTINGS['perpage'], 'int');
 $db->query($query, $params);
 
 $k = 0;
 while ($row = $db->fetch()) {
     if (strlen($row['pict_url']) > 0) {
-        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
+        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
     } else {
         $row['pict_url'] = get_lang_img('nopicture.gif');
     }
 
     $current_time = new DateTime('now', $dt->UTCtimezone);
diff --git a/admin/editauction.php b/admin/editauction.php
index ff16e1c3..26757aa7 100644
--- a/admin/editauction.php
+++ b/admin/editauction.php
@@ -34,11 +34,11 @@ function load_gallery($auc_id)
     $UPLOADED_PICTURES = array();
     if (is_dir(UPLOAD_PATH . $auc_id)) {
         if ($dir = opendir(UPLOAD_PATH . $auc_id)) {
             while ($file = @readdir($dir)) {
                 if ($file != '.' && $file != '..' && strpos($file, 'thumb-') === false) {
-                    $UPLOADED_PICTURES[] = UPLOAD_FOLDER . $auc_id . '/' . $file;
+                    $UPLOADED_PICTURES[] = $file;
                 }
             }
             closedir($dir);
         }
     }
diff --git a/bid.php b/bid.php
index 065e96f3..c8eecb25 100644
--- a/bid.php
+++ b/bid.php
@@ -559,11 +559,11 @@ if (!isset($_POST['action']) || isset($errmsg)) {
     $template->assign_vars(array(
             'PAGE' => 1,
             'ERROR' => (isset($errmsg)) ? $errmsg : '',
             'BID_HISTORY' => (isset($ARETHEREBIDS)) ? $ARETHEREBIDS : '',
             'ID' => $id,
-            'IMAGE' => (!empty($pict_url_plain)) ? '<img src="getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $id . '/' . $pict_url_plain . '" border="0" align="center">' : '&nbsp;',
+            'IMAGE' => (!empty($pict_url_plain)) ? '<img src="getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $id . '&fromfile=' . $pict_url_plain . '" border="0" align="center">' : '',
             'TITLE' => $item_title,
             'CURRENT_BID' => $system->print_money($cbid),
             'ATYPE' => $atype,
             'BID' => $system->print_money_nosymbol($bid),
             'NEXT_BID' => $system->print_money($next_bid),
diff --git a/closed_auctions.php b/closed_auctions.php
index 660bef21..f12a162f 100644
--- a/closed_auctions.php
+++ b/closed_auctions.php
@@ -63,11 +63,11 @@ $auction_data = $db->fetchall();
 foreach ($auction_data as $row) {
     $bid = $row['current_bid'];
     $starting_price = $row['current_bid'];
 
     if (strlen($row['pict_url']) > 0) {
-        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
+        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
     } else {
         $row['pict_url'] = get_lang_img('nopicture.gif');
     }
 
     // number of bids for this auction
diff --git a/getthumb.php b/getthumb.php
index 76f753c8..848e835a 100644
--- a/getthumb.php
+++ b/getthumb.php
@@ -12,13 +12,35 @@
  *   sold. If you have been sold this script, get a refund.
  ***************************************************************************/
 
 include 'common.php';
 
+// get passed values
 $w = (isset($_GET['w'])) ? intval($_GET['w']) : '';
-$_w = $w;
-$fromfile = (isset($_GET['fromfile'])) ? $_GET['fromfile'] : '';
+$fromfile = $_GET['fromfile'];
+$auction_id = $_GET['auction_id'];
+
+// check passed values
+if (!isset($_GET['fromfile']) ||
+	!isset($_GET['auction_id']) || !is_numeric($auction_id)) {
+    ErrorPNG($ERR_716);
+    exit;
+} elseif (!file_exists($_GET['fromfile']) && !fopen($_GET['fromfile'], 'r')) {
+    ErrorPNG($ERR_716);
+    exit;
+}
+
+if ($fromfile != '') {
+	// clean fromfile
+	$fromfile = basename($fromfile);
+	// build file path
+	$file_path = UPLOAD_FOLDER . $auction_id . '/' . $fromfile;
+} else {
+	// if empty filename just show default image
+	$file_path = MAIN_PATH . 'images/email_alerts/default_item_img.jpg';
+}
+
 $nomanage = false;
 $accepted_widths = array(
     $system->SETTINGS['thumb_show'],
     $system->SETTINGS['thumb_list'],
     430,
@@ -45,21 +67,12 @@ function load_image($file, $mime, $image_type, $output_type)
     $funcall = "image$output_type";
     $funcall($image);
     exit;
 }
 
-// control parameters and file existence
-if (!isset($_GET['fromfile']) || $fromfile == '') {
-    ErrorPNG($ERR_716);
-    exit;
-} elseif (!file_exists($_GET['fromfile']) && !fopen($_GET['fromfile'], 'r')) {
-    ErrorPNG($ERR_716);
-    exit;
-}
-
 if (file_exists(UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile))) {
-    $img = getimagesize($fromfile);
+    $img = getimagesize($file_path);
     switch ($img[2]) {
         case IMAGETYPE_GIF:
             if (!(imagetypes() &IMG_GIF)) {
                 if (!function_exists('imagecreatefromgif')) {
                     $nomanage = true;
@@ -96,11 +109,11 @@ if (file_exists(UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile))) {
     if (function_exists('imagetypes')) {
         if (!is_dir(UPLOAD_PATH . 'cache')) {
             mkdir(UPLOAD_PATH . 'cache', 0777);
         }
 
-        $img = @getimagesize($fromfile);
+        $img = @getimagesize($file_path);
         if (is_array($img)) {
             switch ($img[2]) {
                 case IMAGETYPE_GIF:
                     if (!(imagetypes() &IMG_GIF)) {
                         if (!function_exists('imagecreatefromgif')) {
@@ -139,11 +152,11 @@ if (file_exists(UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile))) {
             ErrorPNG($ERR_710);
             exit;
         }
         if ($w == '') {
             // just load the image
-            load_image($fromfile, $img['mime'], $image_type, $output_type);
+            load_image($file_path, $img['mime'], $image_type, $output_type);
         } else {
             // check image orientation
             if ($img[0] < $img[1]) {
                 $h = $w;
                 $ratio = floatval($img[1] / $h);
@@ -154,13 +167,13 @@ if (file_exists(UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile))) {
             }
         
             $ou = imagecreatetruecolor($w, $h);
             imagealphablending($ou, false);
             $funcall = "imagecreatefrom$image_type";
-            imagecopyresampled($ou, $funcall($fromfile), 0, 0, 0, 0, $w, $h, $img[0], $img[1]);
+            imagecopyresampled($ou, $funcall($file_path), 0, 0, 0, 0, $w, $h, $img[0], $img[1]);
             $funcall = "image$output_type";
-            $funcall($ou, UPLOAD_PATH . 'cache/' . $_w . '-' . md5($fromfile));
+            $funcall($ou, UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile));
             header('Content-type: ' . $img['mime']);
             $funcall($ou);
             exit;
         }
     } else {
diff --git a/includes/browseitems.inc.php b/includes/browseitems.inc.php
index b7cdf685..341b6def 100644
--- a/includes/browseitems.inc.php
+++ b/includes/browseitems.inc.php
@@ -114,11 +114,11 @@ function build_items($row)
 {
     global $system;
 
     // image icon
     if (!empty($row['pict_url'])) {
-        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_list'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
+        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_list'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
     } else {
         $row['pict_url'] = get_lang_img('nopicture.gif');
     }
 
     if ($row['current_bid'] == 0) {
diff --git a/includes/functions_sell.php b/includes/functions_sell.php
index 08b4c4da..327dcc77 100644
--- a/includes/functions_sell.php
+++ b/includes/functions_sell.php
@@ -396,11 +396,11 @@ function get_fee($minimum_bid, $just_fee = true)
         'buynow_fee' => 0,
         'picture_fee' => 0,
         'extracat_fee' => 0
     );
     while ($row = $db->fetch()) {
-        if ($minimum_bid >= $row['fee_from'] && $minimum_bid <= $row['fee_to'] && $row['type'] == 'setup') {
+        if ($minimum_bid >= $row['fee_from'] && $minimum_bid <= $row['fee_to'] && $row['type'] == 'setup_fee') {
             if ($row['fee_type'] == 'flat') {
                 $fee_data['setup_fee'] = $row['value'];
                 $fee_value = bcadd($fee_value, $row['value'], $system->SETTINGS['moneydecimals']);
             } else {
                 $tmp = bcdiv($row['value'], '100', $system->SETTINGS['moneydecimals']);
diff --git a/index.php b/index.php
index ceace577..994f00ce 100644
--- a/index.php
+++ b/index.php
@@ -102,11 +102,11 @@ while ($row = $db->fetch()) {
     $high_bid = ($row['bn_only']) ? $row['buy_now'] : $high_bid;
     $template->assign_block_vars('featured', array(
             'ENDS' => $ends_string,
             'ID' => $row['id'],
             'BID' => $system->print_money($high_bid),
-            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&amp;fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'] : 'images/email_alerts/default_item_img.jpg',
+            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'] : '',
             'TITLE' => htmlspecialchars($row['title'])
             ));
     $i++;
 }
 
@@ -186,11 +186,11 @@ while ($row = $db->fetch()) {
     $high_bid = ($row['num_bids'] == 0) ? $row['minimum_bid'] : $row['current_bid'];
     $template->assign_block_vars('hotitems', array(
             'ENDS' => $ends_string,
             'ID' => $row['id'],
             'BID' => $system->print_money($high_bid),
-            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&amp;fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'] : 'images/email_alerts/default_item_img.jpg',
+            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&amp;fromfile=' . $row['pict_url'] : '',
             'TITLE' => htmlspecialchars($row['title'])
             ));
 }
 $hot_items = ($i > 0) ? true : false;
 
diff --git a/item.php b/item.php
index b1cc285e..b0b768ec 100644
--- a/item.php
+++ b/item.php
@@ -464,11 +464,11 @@ if ($auction_data['shipping'] == 1) {
 $template->assign_vars(array(
         'ID' => $auction_data['id'],
         'TITLE' => htmlspecialchars($auction_data['title']),
         'SUBTITLE' => htmlspecialchars($auction_data['subtitle']),
         'AUCTION_DESCRIPTION' => $auction_data['description'],
-        'PIC_URL' => UPLOAD_FOLDER . $id . '/' . $auction_data['pict_url'],
+        'PIC_URL' => $auction_data['pict_url'],
         'SHIPPING_COST' => ($auction_data['shipping_cost'] > 0) ? $system->print_money($auction_data['shipping_cost']) : $MSG['1152'],
         'ADDITIONAL_SHIPPING_COST' => $system->print_money($auction_data['additional_shipping_cost']),
         'COUNTRY' => $auction_data['country'],
         'CITY' => $auction_data['city'],
         'ZIP' => $auction_data['zip'],
diff --git a/register.php b/register.php
index a5021b23..0f616734 100644
--- a/register.php
+++ b/register.php
@@ -446,19 +446,19 @@ $template->assign_vars(array(
         'MISSING11' => ($missing['tel']) ? 1 : 0,
         'FEES'=> $system->print_money($signup_fee),
 
         'V_YNEWSL' => ((isset($_POST['TPL_nletter']) && $_POST['TPL_nletter'] == 1) || !isset($_POST['TPL_nletter'])) ? 'checked=true' : '',
         'V_NNEWSL' => (isset($_POST['TPL_nletter']) && $_POST['TPL_nletter'] == 2) ? 'checked=true' : '',
-        'V_YNAME' => (isset($_POST['TPL_name'])) ? $_POST['TPL_name'] : '',
-        'V_UNAME' => (isset($_POST['TPL_nick'])) ? $_POST['TPL_nick'] : '',
-        'V_EMAIL' => (isset($_POST['TPL_email'])) ? $_POST['TPL_email'] : '',
-        'V_YEAR' => (isset($_POST['TPL_year'])) ? $_POST['TPL_year'] : '',
-        'V_ADDRE' => (isset($_POST['TPL_address'])) ? $_POST['TPL_address'] : '',
-        'V_CITY' => (isset($_POST['TPL_city'])) ? $_POST['TPL_city'] : '',
-        'V_PROV' => (isset($_POST['TPL_prov'])) ? $_POST['TPL_prov'] : '',
-        'V_POSTCODE' => (isset($_POST['TPL_zip'])) ? $_POST['TPL_zip'] : '',
-        'V_PHONE' => (isset($_POST['TPL_phone'])) ? $_POST['TPL_phone'] : ''
+        'V_YNAME' => (isset($_POST['TPL_name'])) ? $system->cleanvars($_POST['TPL_name']) : '',
+        'V_UNAME' => (isset($_POST['TPL_nick'])) ? $system->cleanvars($_POST['TPL_nick']) : '',
+        'V_EMAIL' => (isset($_POST['TPL_email'])) ? $system->cleanvars($_POST['TPL_email']) : '',
+        'V_YEAR' => (isset($_POST['TPL_year'])) ? $system->cleanvars($_POST['TPL_year']) : '',
+        'V_ADDRE' => (isset($_POST['TPL_address'])) ? $system->cleanvars($_POST['TPL_address']) : '',
+        'V_CITY' => (isset($_POST['TPL_city'])) ? $system->cleanvars($_POST['TPL_city']) : '',
+        'V_PROV' => (isset($_POST['TPL_prov'])) ? $system->cleanvars($_POST['TPL_prov']) : '',
+        'V_POSTCODE' => (isset($_POST['TPL_zip'])) ? $system->cleanvars($_POST['TPL_zip']) : '',
+        'V_PHONE' => (isset($_POST['TPL_phone'])) ? $system->cleanvars($_POST['TPL_phone']) : ''
         ));
 
 include 'header.php';
 $template->set_filenames(array(
         'body' => 'register.tpl'
diff --git a/themes/adminClassic/editauction.tpl b/themes/adminClassic/editauction.tpl
index e2d35e40..589ccc18 100644
--- a/themes/adminClassic/editauction.tpl
+++ b/themes/adminClassic/editauction.tpl
@@ -69,11 +69,11 @@
 						<td>
 							<div>{L_1105}</div>
 <!-- BEGIN gallery -->
 							<div class="button" style=" height:100px; float:left; margin:5px; padding:10px 5px 20px 10px;">
 								<a href="{SITEURL}/{gallery.V}" title="{gallery.V}" target="_blank">
-									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}" border="0" height="100px">
+									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}&auction_id={ID}" border="0" height="100px">
 								</a><br>
 								<input type="checkbox" name="gallery[]" value="{gallery.V}">
 							</div>
 <!-- END gallery -->
 						</td>
diff --git a/themes/adminModern/editauction.tpl b/themes/adminModern/editauction.tpl
index 4e290a7e..c11f7b12 100644
--- a/themes/adminModern/editauction.tpl
+++ b/themes/adminModern/editauction.tpl
@@ -69,11 +69,11 @@
 						<td>
 							<div>{L_1105}</div>
 <!-- BEGIN gallery -->
 							<div style="width:50px; float: left;">
 								<a href="{SITEURL}/{gallery.V}" title="{gallery.V}" target="_blank">
-									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}" border="0" hspace="10">
+									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}&auction_id={ID}" border="0" hspace="10">
 								</a>
 								<input type="checkbox" name="gallery[]" value="{gallery.V}">
 							</div>
 <!-- END gallery -->
 						</td>
diff --git a/themes/classic/item.tpl b/themes/classic/item.tpl
index a573ffc1..14a00b93 100644
--- a/themes/classic/item.tpl
+++ b/themes/classic/item.tpl
@@ -79,11 +79,11 @@ $(document).ready(function() {
 <!-- IF B_HASIMAGE -->
 								<td width="10%" valign="top">
 									<table bgcolor="#ffffff">
 										<tr>
 											<td align='center'>
-												<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={PIC_URL}" border="0" align="center"><br>
+												<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={PIC_URL}&auction_id={ID}" border="0" align="center"><br>
 	<!-- IF B_HASGALELRY -->
 												<a href="#gallery"><img src="{SITEURL}images/gallery.gif" border="0" alt="gallery"> {L_694}</a>
 	<!-- ENDIF -->
 											</td>
 										</tr>
@@ -306,11 +306,11 @@ $(document).ready(function() {
 					<table>
 						<tr>
 	<!-- BEGIN gallery -->
 							<td>
 								<a href="{SITEURL}{UPLOADEDPATH}{ID}/{gallery.V}" title="" data-lightbox="gallery">
-									<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={UPLOADEDPATH}{ID}/{gallery.V}" border="0" hspace="10">
+									<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={gallery.V}&auction_id={ID}" border="0" hspace="10">
 								</a>
 							</td>
 	<!-- END gallery -->
 						</tr>
 					</table>
diff --git a/themes/modern/item.tpl b/themes/modern/item.tpl
index 25881532..cceba6f3 100644
--- a/themes/modern/item.tpl
+++ b/themes/modern/item.tpl
@@ -55,20 +55,20 @@ $(document).ready(function() {
 <!-- IF B_HASIMAGE -->
 				<div class="main-gallery panel panel-default">
 					<div class="panel-heading"><span class="label label-default">{L_113}: {ID}</span></div>
 					<div class="panel-body">
 						<div class="col-md-12">
-							<img class="img-rounded img-responsive center-block" src="{SITEURL}getthumb.php?w=430&fromfile={PIC_URL}" border="0" align="center" width="430px">
+							<img class="img-rounded img-responsive center-block" src="{SITEURL}getthumb.php?w=430&fromfile={PIC_URL}&auction_id={ID}" border="0" align="center" width="430px">
 						</div>
 	<!-- IF B_HASGALELRY -->
 						<div>
 							<a name="gallery"></a>
 							<div id="gallery">
 		<!-- BEGIN gallery -->
 								<div class="col-md-4 col-xs-4 col-sm-4">
 									<a href="{SITEURL}{UPLOADEDPATH}{ID}/{gallery.V}" title="" data-lightbox="gallery">
-									<img class="img-rounded img-responsive" src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={UPLOADEDPATH}{ID}/{gallery.V}" border="0"></a>
+									<img class="img-rounded img-responsive" src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={gallery.V}&auction_id={ID}" border="0"></a>
 								</div>
 		<!-- END gallery -->
 							</div>
 						</div>
 	<!-- ENDIF -->
diff --git a/user_login.php b/user_login.php
index ab98569b..8d386c11 100644
--- a/user_login.php
+++ b/user_login.php
@@ -122,11 +122,11 @@ if (isset($_POST['action']) && isset($_POST['username']) && isset($_POST['passwo
     }
 }
 
 $template->assign_vars(array(
         'ERROR' => (isset($ERR)) ? $ERR : '',
-        'USER' => (isset($_POST['username'])) ? $_POST['username'] : ''
+        'USER' => (isset($_POST['username'])) ? $system->cleanvars($_POST['username']) : ''
         ));
 
 include 'header.php';
 $template->set_filenames(array(
         'body' => 'user_login.tpl'
diff --git a/yourauctions.php b/yourauctions.php
index 53f09125..0a3244bc 100644
--- a/yourauctions.php
+++ b/yourauctions.php
@@ -97,12 +97,13 @@ $PAGES = ($TOTALAUCTIONS == 0) ? 1 : ceil($TOTALAUCTIONS / $system->SETTINGS['pe
 // Handle columns sorting variables
 if (!isset($_SESSION['oa_ord']) && empty($_GET['oa_ord'])) {
     $_SESSION['oa_ord'] = 'title';
     $_SESSION['oa_type'] = 'asc';
 } elseif (!empty($_GET['oa_ord'])) {
-    $_SESSION['oa_ord'] = $_GET['oa_ord'];
-    $_SESSION['oa_type'] = $_GET['oa_type'];
+	// check oa_ord && oa_type are valid
+    $_SESSION['oa_ord'] = (in_array($_GET['oa_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['oa_ord'] : 'title';
+    $_SESSION['oa_type'] = (in_array($_GET['oa_type'], array('asc', 'desc'))) ? $_GET['oa_type'] : 'asc';
 } elseif (isset($_SESSION['oa_ord']) && empty($_GET['oa_ord'])) {
     $_SESSION['oa_nexttype'] = $_SESSION['oa_type'];
 }
 if (!isset($_SESSION['oa_nexttype']) || $_SESSION['oa_nexttype'] == 'desc') {
     $_SESSION['oa_nexttype'] = 'asc';
diff --git a/yourauctions_c.php b/yourauctions_c.php
index 3d89e1a3..089bc25d 100644
--- a/yourauctions_c.php
+++ b/yourauctions_c.php
@@ -202,12 +202,13 @@ $PAGES = ($TOTALAUCTIONS == 0) ? 1 : ceil($TOTALAUCTIONS / $system->SETTINGS['pe
 // Handle columns sorting variables
 if (!isset($_SESSION['ca_ord']) && empty($_GET['ca_ord'])) {
     $_SESSION['ca_ord'] = 'title';
     $_SESSION['ca_type'] = 'asc';
 } elseif (!empty($_GET['ca_ord'])) {
-    $_SESSION['ca_ord'] = $_GET['ca_ord'];
-    $_SESSION['ca_type'] = $_GET['ca_type'];
+	// check oa_ord && oa_type are valid
+    $_SESSION['ca_ord'] = (in_array($_GET['ca_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['ca_ord'] : 'title';
+    $_SESSION['ca_type'] = (in_array($_GET['ca_type'], array('asc', 'desc'))) ? $_GET['ca_type'] : 'asc';
 } elseif (isset($_SESSION['ca_ord']) && empty($_GET['ca_ord'])) {
     $_SESSION['ca_nexttype'] = $_SESSION['ca_type'];
 }
 
 if (!isset($_SESSION['ca_nexttype']) || $_SESSION['ca_nexttype'] == 'desc') {
diff --git a/yourauctions_p.php b/yourauctions_p.php
index 761dfa51..e1770eb3 100644
--- a/yourauctions_p.php
+++ b/yourauctions_p.php
@@ -107,12 +107,13 @@ $PAGES = ($TOTALAUCTIONS == 0) ? 1 : ceil($TOTALAUCTIONS / $system->SETTINGS['pe
 // Handle columns sorting variables
 if (!isset($_SESSION['pa_ord']) && empty($_GET['pa_ord'])) {
     $_SESSION['pa_ord'] = 'title';
     $_SESSION['pa_type'] = 'asc';
 } elseif (!empty($_GET['pa_ord'])) {
-    $_SESSION['pa_ord'] = $_GET['pa_ord'];
-    $_SESSION['pa_type'] = $_GET['pa_type'];
+	// check oa_ord && oa_type are valid
+    $_SESSION['pa_ord'] = (in_array($_GET['pa_ord'], array('title', 'starts', 'ends'))) ? $_GET['pa_ord'] : 'title';
+    $_SESSION['pa_type'] = (in_array($_GET['pa_type'], array('asc', 'desc'))) ? $_GET['pa_type'] : 'asc';
 } elseif (isset($_SESSION['pa_ord']) && empty($_GET['pa_ord'])) {
     $_SESSION['pa_nexttype'] = $_SESSION['pa_type'];
 }
 
 if (!isset($_SESSION['pa_nexttype']) || $_SESSION['pa_nexttype'] == 'desc') {
diff --git a/yourauctions_s.php b/yourauctions_s.php
index fa909638..b3343bae 100644
--- a/yourauctions_s.php
+++ b/yourauctions_s.php
@@ -79,12 +79,13 @@ $PAGES = ($TOTALAUCTIONS == 0) ? 1 : ceil($TOTALAUCTIONS / $system->SETTINGS['pe
 // Handle columns sorting variables
 if (!isset($_SESSION['sa_ord']) && empty($_GET['sa_ord'])) {
     $_SESSION['sa_ord'] = 'title';
     $_SESSION['sa_type'] = 'asc';
 } elseif (!empty($_GET['sa_ord'])) {
-    $_SESSION['sa_ord'] = $_GET['sa_ord'];
-    $_SESSION['sa_type'] = $_GET['sa_type'];
+	// check oa_ord && oa_type are valid
+    $_SESSION['sa_ord'] = (in_array($_GET['sa_ord'], array('title', 'num_bids', 'current_bid'))) ? $_GET['sa_ord'] : 'title';
+    $_SESSION['sa_type'] = (in_array($_GET['sa_type'], array('asc', 'desc'))) ? $_GET['sa_type'] : 'asc';
 } elseif (isset($_SESSION['sa_ord']) && empty($_GET['sa_ord'])) {
     $_SESSION['sa_nexttype'] = $_SESSION['sa_type'];
 }
 
 if (!isset($_SESSION['sa_nexttype']) || $_SESSION['sa_nexttype'] == 'desc') {
diff --git a/yourauctions_sold.php b/yourauctions_sold.php
index 578e785d..1cf2a08a 100644
--- a/yourauctions_sold.php
+++ b/yourauctions_sold.php
@@ -147,12 +147,13 @@ $PAGES = ($TOTALAUCTIONS == 0) ? 1 : ceil($TOTALAUCTIONS / $system->SETTINGS['pe
 // Handle columns sorting variables
 if (!isset($_SESSION['solda_ord']) && empty($_GET['solda_ord'])) {
     $_SESSION['solda_ord'] = 'title';
     $_SESSION['solda_type'] = 'asc';
 } elseif (!empty($_GET['solda_ord'])) {
-    $_SESSION['solda_ord'] = $_GET['solda_ord'];
-    $_SESSION['solda_type'] = $_GET['solda_type'];
+	// check oa_ord && oa_type are valid
+    $_SESSION['solda_ord'] = (in_array($_GET['solda_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['solda_ord'] : 'title';
+    $_SESSION['solda_type'] = (in_array($_GET['solda_type'], array('asc', 'desc'))) ? $_GET['solda_type'] : 'asc';
 } elseif (isset($_SESSION['solda_ord']) && empty($_GET['solda_ord'])) {
     $_SESSION['solda_nexttype'] = $_SESSION['solda_type'];
 }
 
 if (!isset($_SESSION['solda_nexttype']) || $_SESSION['solda_nexttype'] == 'desc') {

Vulnerable code:         $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
                    $UPLOADED_PICTURES[] = UPLOAD_FOLDER . $auc_id . '/' . $file;
            'IMAGE' => (!empty($pict_url_plain)) ? '<img src="getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $id . '/' . $pict_url_plain . '" border="0" align="center">' : '&nbsp;',
        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
$_w = $w;
$fromfile = (isset($_GET['fromfile'])) ? $_GET['fromfile'] : '';
// control parameters and file existence
if (!isset($_GET['fromfile']) || $fromfile == '') {
    ErrorPNG($ERR_716);
    exit;
} elseif (!file_exists($_GET['fromfile']) && !fopen($_GET['fromfile'], 'r')) {
    ErrorPNG($ERR_716);
    exit;
}

    $img = getimagesize($fromfile);
        $img = @getimagesize($fromfile);
            load_image($fromfile, $img['mime'], $image_type, $output_type);
            imagecopyresampled($ou, $funcall($fromfile), 0, 0, 0, 0, $w, $h, $img[0], $img[1]);
            $funcall($ou, UPLOAD_PATH . 'cache/' . $_w . '-' . md5($fromfile));
        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_list'] . '&fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'];
        if ($minimum_bid >= $row['fee_from'] && $minimum_bid <= $row['fee_to'] && $row['type'] == 'setup') {
            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&amp;fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'] : 'images/email_alerts/default_item_img.jpg',
            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&amp;fromfile=' . UPLOAD_FOLDER . $row['id'] . '/' . $row['pict_url'] : 'images/email_alerts/default_item_img.jpg',
        'PIC_URL' => UPLOAD_FOLDER . $id . '/' . $auction_data['pict_url'],
        'V_YNAME' => (isset($_POST['TPL_name'])) ? $_POST['TPL_name'] : '',
        'V_UNAME' => (isset($_POST['TPL_nick'])) ? $_POST['TPL_nick'] : '',
        'V_EMAIL' => (isset($_POST['TPL_email'])) ? $_POST['TPL_email'] : '',
        'V_YEAR' => (isset($_POST['TPL_year'])) ? $_POST['TPL_year'] : '',
        'V_ADDRE' => (isset($_POST['TPL_address'])) ? $_POST['TPL_address'] : '',
        'V_CITY' => (isset($_POST['TPL_city'])) ? $_POST['TPL_city'] : '',
        'V_PROV' => (isset($_POST['TPL_prov'])) ? $_POST['TPL_prov'] : '',
        'V_POSTCODE' => (isset($_POST['TPL_zip'])) ? $_POST['TPL_zip'] : '',
        'V_PHONE' => (isset($_POST['TPL_phone'])) ? $_POST['TPL_phone'] : ''
									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}" border="0" height="100px">
									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}" border="0" hspace="10">
												<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={PIC_URL}" border="0" align="center"><br>
									<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={UPLOADEDPATH}{ID}/{gallery.V}" border="0" hspace="10">
							<img class="img-rounded img-responsive center-block" src="{SITEURL}getthumb.php?w=430&fromfile={PIC_URL}" border="0" align="center" width="430px">
									<img class="img-rounded img-responsive" src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={UPLOADEDPATH}{ID}/{gallery.V}" border="0"></a>
        'USER' => (isset($_POST['username'])) ? $_POST['username'] : ''
    $_SESSION['oa_ord'] = $_GET['oa_ord'];
    $_SESSION['oa_type'] = $_GET['oa_type'];
    $_SESSION['ca_ord'] = $_GET['ca_ord'];
    $_SESSION['ca_type'] = $_GET['ca_type'];
    $_SESSION['pa_ord'] = $_GET['pa_ord'];
    $_SESSION['pa_type'] = $_GET['pa_type'];
    $_SESSION['sa_ord'] = $_GET['sa_ord'];
    $_SESSION['sa_type'] = $_GET['sa_type'];
    $_SESSION['solda_ord'] = $_GET['solda_ord'];
    $_SESSION['solda_type'] = $_GET['solda_type'];
Fixed code:         $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
                    $UPLOADED_PICTURES[] = $file;
            'IMAGE' => (!empty($pict_url_plain)) ? '<img src="getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $id . '&fromfile=' . $pict_url_plain . '" border="0" align="center">' : '',
        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
// get passed values
$fromfile = $_GET['fromfile'];
$auction_id = $_GET['auction_id'];

// check passed values
if (!isset($_GET['fromfile']) ||
	!isset($_GET['auction_id']) || !is_numeric($auction_id)) {
    ErrorPNG($ERR_716);
    exit;
} elseif (!file_exists($_GET['fromfile']) && !fopen($_GET['fromfile'], 'r')) {
    ErrorPNG($ERR_716);
    exit;
}

if ($fromfile != '') {
	// clean fromfile
	$fromfile = basename($fromfile);
	// build file path
	$file_path = UPLOAD_FOLDER . $auction_id . '/' . $fromfile;
} else {
	// if empty filename just show default image
	$file_path = MAIN_PATH . 'images/email_alerts/default_item_img.jpg';
}

    $img = getimagesize($file_path);
        $img = @getimagesize($file_path);
            load_image($file_path, $img['mime'], $image_type, $output_type);
            imagecopyresampled($ou, $funcall($file_path), 0, 0, 0, 0, $w, $h, $img[0], $img[1]);
            $funcall($ou, UPLOAD_PATH . 'cache/' . $w . '-' . md5($fromfile));
        $row['pict_url'] = $system->SETTINGS['siteurl'] . 'getthumb.php?w=' . $system->SETTINGS['thumb_list'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'];
        if ($minimum_bid >= $row['fee_from'] && $minimum_bid <= $row['fee_to'] && $row['type'] == 'setup_fee') {
            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&fromfile=' . $row['pict_url'] : '',
            'IMAGE' => (!empty($row['pict_url'])) ? 'getthumb.php?w=' . $system->SETTINGS['thumb_show'] . '&auction_id=' . $row['id'] . '&amp;fromfile=' . $row['pict_url'] : '',
        'PIC_URL' => $auction_data['pict_url'],
        'V_YNAME' => (isset($_POST['TPL_name'])) ? $system->cleanvars($_POST['TPL_name']) : '',
        'V_UNAME' => (isset($_POST['TPL_nick'])) ? $system->cleanvars($_POST['TPL_nick']) : '',
        'V_EMAIL' => (isset($_POST['TPL_email'])) ? $system->cleanvars($_POST['TPL_email']) : '',
        'V_YEAR' => (isset($_POST['TPL_year'])) ? $system->cleanvars($_POST['TPL_year']) : '',
        'V_ADDRE' => (isset($_POST['TPL_address'])) ? $system->cleanvars($_POST['TPL_address']) : '',
        'V_CITY' => (isset($_POST['TPL_city'])) ? $system->cleanvars($_POST['TPL_city']) : '',
        'V_PROV' => (isset($_POST['TPL_prov'])) ? $system->cleanvars($_POST['TPL_prov']) : '',
        'V_POSTCODE' => (isset($_POST['TPL_zip'])) ? $system->cleanvars($_POST['TPL_zip']) : '',
        'V_PHONE' => (isset($_POST['TPL_phone'])) ? $system->cleanvars($_POST['TPL_phone']) : ''
									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}&auction_id={ID}" border="0" height="100px">
									<img src="{SITEURL}getthumb.php?fromfile={gallery.V}&auction_id={ID}" border="0" hspace="10">
												<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={PIC_URL}&auction_id={ID}" border="0" align="center"><br>
									<img src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={gallery.V}&auction_id={ID}" border="0" hspace="10">
							<img class="img-rounded img-responsive center-block" src="{SITEURL}getthumb.php?w=430&fromfile={PIC_URL}&auction_id={ID}" border="0" align="center" width="430px">
									<img class="img-rounded img-responsive" src="{SITEURL}getthumb.php?w={THUMBWIDTH}&fromfile={gallery.V}&auction_id={ID}" border="0"></a>
        'USER' => (isset($_POST['username'])) ? $system->cleanvars($_POST['username']) : ''
	// check oa_ord && oa_type are valid
    $_SESSION['oa_ord'] = (in_array($_GET['oa_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['oa_ord'] : 'title';
    $_SESSION['oa_type'] = (in_array($_GET['oa_type'], array('asc', 'desc'))) ? $_GET['oa_type'] : 'asc';
	// check oa_ord && oa_type are valid
    $_SESSION['ca_ord'] = (in_array($_GET['ca_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['ca_ord'] : 'title';
    $_SESSION['ca_type'] = (in_array($_GET['ca_type'], array('asc', 'desc'))) ? $_GET['ca_type'] : 'asc';
	// check oa_ord && oa_type are valid
    $_SESSION['pa_ord'] = (in_array($_GET['pa_ord'], array('title', 'starts', 'ends'))) ? $_GET['pa_ord'] : 'title';
    $_SESSION['pa_type'] = (in_array($_GET['pa_type'], array('asc', 'desc'))) ? $_GET['pa_type'] : 'asc';
	// check oa_ord && oa_type are valid
    $_SESSION['sa_ord'] = (in_array($_GET['sa_ord'], array('title', 'num_bids', 'current_bid'))) ? $_GET['sa_ord'] : 'title';
    $_SESSION['sa_type'] = (in_array($_GET['sa_type'], array('asc', 'desc'))) ? $_GET['sa_type'] : 'asc';
	// check oa_ord && oa_type are valid
    $_SESSION['solda_ord'] = (in_array($_GET['solda_ord'], array('title', 'starts', 'ends', 'num_bids', 'current_bid'))) ? $_GET['solda_ord'] : 'title';
    $_SESSION['solda_type'] = (in_array($_GET['solda_type'], array('asc', 'desc'))) ? $_GET['solda_type'] : 'asc';