CVE-2021-4313: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in NethServer phonenehome. It has been rated as critical. This issue affects the function get_info/get_country_coor of the file server/index.php. The manipulation leads to sql injection. The identifier of the patch is 759c30b0ddd7d493836bbdf695cf71624b377391. It is recommended to apply a patch to fix this issue. The identifier VDB-218393 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-16T12:15Z
Repository: https://github.com/NethServer/nethserver-phonehome
Language: PHP
Files changed: server/index.php
Commit date: 2021-09-28 03:48:31 -0400
Commit message: fix sql-injection

Diff: diff --git a/server/index.php b/server/index.php
index 1e71430..b7efc4e 100644
--- a/server/index.php
+++ b/server/index.php
@@ -90,22 +90,22 @@
                                     reg_date,
                                     COUNT(release_tag) AS num
                             FROM phone_home_tb ";
 
         if ($interval!=='1') {
-          $sql .= " WHERE reg_date >= DATE_SUB(CURDATE(), INTERVAL $interval DAY)";
+          $sql .= " WHERE reg_date >= DATE_SUB(CURDATE(), INTERVAL :interval DAY)";
         }
 
         $sql .= " GROUP BY release_tag, country_code
         ) AS t
         GROUP BY  country_code;";
 
         // prepare statement
         $stmt = $conn->prepare($sql);
 
         // execute query
-        $stmt->execute();
+        $stmt->execute(array(':interval' => intval($interval)));
 
         // create new empty array
         $infos = array();
 
         // set the resulting array to associative
@@ -146,21 +146,21 @@
         // select query
         $sql = "SELECT lat, lng
 
                 FROM country_name_map
 
-                WHERE code = '$country_code'";
-        }
+                WHERE code = ':country_code'";
+}
         catch(PDOException $e) {
           echo $e->getMessage();
         }
 
         // prepare statement
         $stmt = $conn->prepare($sql);
 
         // execute query
-        $stmt->execute();
+        $stmt->execute(array(':country_code' => $country_code));
 
         // create new empty array
         $infos = array();
 
         // set the resulting array to associative

Vulnerable code:           $sql .= " WHERE reg_date >= DATE_SUB(CURDATE(), INTERVAL $interval DAY)";
        $stmt->execute();
                WHERE code = '$country_code'";
        }
        $stmt->execute();
Fixed code:           $sql .= " WHERE reg_date >= DATE_SUB(CURDATE(), INTERVAL :interval DAY)";
        $stmt->execute(array(':interval' => intval($interval)));
                WHERE code = ':country_code'";
}
        $stmt->execute(array(':country_code' => $country_code));