CVE-2013-3524: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter.  NOTE: this was originally reported as a problem in phpVMS.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2013-05-10T21:55Z
Repository: https://github.com/DavidJClark/phpVMS-PopUpNews
Language: PHP
Files changed: core/common/PopUpNewsData.class.php, core/modules/PopUpNews/PopUpNews.php
Commit date: 2013-04-16 11:03:54 -0400
Commit message: Update due to SQL injection exploit

Diff: diff --git a/core/common/PopUpNewsData.class.php b/core/common/PopUpNewsData.class.php
index 10d44d5..44d6f4a 100644
--- a/core/common/PopUpNewsData.class.php
+++ b/core/common/PopUpNewsData.class.php
@@ -13,17 +13,17 @@ class PopUpNewsData extends CodonData
 {	 
     public function popupnewsitem($id)
     {
         $query = 'SELECT *
                  FROM ' . TABLE_PREFIX .'news
-                 WHERE id=' . $id . ' ';
+                 WHERE id=' . DB::escape($id) . ' ';
 
         return DB::get_row($query);
     }
     
     public function get_news_list($howmany) {
         $sql = 'SELECT id, subject, body, postedby, UNIX_TIMESTAMP(postdate) AS postdate
-		FROM ' . TABLE_PREFIX .'news ORDER BY postdate DESC LIMIT '.$howmany;
+		FROM ' . TABLE_PREFIX .'news ORDER BY postdate DESC LIMIT '.DB::escape($howmany);
 
         return DB::get_results($sql);
     }
 }
\ No newline at end of file
diff --git a/core/modules/PopUpNews/PopUpNews.php b/core/modules/PopUpNews/PopUpNews.php
index 99cb515..ccd0a00 100644
--- a/core/modules/PopUpNews/PopUpNews.php
+++ b/core/modules/PopUpNews/PopUpNews.php
@@ -11,18 +11,22 @@
 
 class PopUpNews extends CodonModule
 {
     public function popupnewsitem($id) {
 
+                if(!is_numeric($id)){header('Location: '.url('/'));}
+        
                 $result = PopUpNewsData::popupnewsitem($id);
                 Template::Set('item', $result);
                 Template::Show('popupnews/popupnews_item.tpl');
         }
     
 
     public function PopUpNewsList($howmany = 5)
     {
+        if(!is_numeric($id)){exit;}
+        
         $res = PopUpNewsData::get_news_list($howmany);
 
         if(!$res)
             return;
 

Vulnerable code:                  WHERE id=' . $id . ' ';
		FROM ' . TABLE_PREFIX .'news ORDER BY postdate DESC LIMIT '.$howmany;
Fixed code:                  WHERE id=' . DB::escape($id) . ' ';
		FROM ' . TABLE_PREFIX .'news ORDER BY postdate DESC LIMIT '.DB::escape($howmany);
                if(!is_numeric($id)){header('Location: '.url('/'));}
        
        if(!is_numeric($id)){exit;}