CVE-2017-1000423: Improper Input Validation (CWE-20)
value: b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2018-01-02T20:29Z
Repository: https://github.com/b2evolution/b2evolution
Language: PHP
Files changed: install/_functions_install.php
Commit date: 2017-08-10 10:39:03 +0300
Commit message: Format install params

Diff: diff --git a/install/_functions_install.php b/install/_functions_install.php
index c4c2e16055..96c065da59 100644
--- a/install/_functions_install.php
+++ b/install/_functions_install.php
@@ -1796,12 +1796,23 @@ function check_quick_install_request()
  *
  * @return string
  */
 function format_install_param( $value )
 {
-	$value = str_replace( array( "'",  "\$" ), array( "\'", "\\$" ), $value );
-	return preg_replace( "#([\\\\]*)(\\\\\\\')#", "\\\\\\\\\\\\\\\\\'", $value );
+	// We need backslashes only for single quote(') and backslash(\):
+	$value = addcslashes( $value, "'\\" );
+	/*
+		The below code excludes even number of slashes, because we need always odd
+		number of slashes before single quote(') to avoid a broken string value.
+		Examples for source and result:
+		  \'     => \'         (1 slash is not converted because it is used only for single quote backslashing)
+		  \\'    => \\\'       (2 slashes are converted to 3, because only first one slash must be backslashed)
+		  \\\'   => \\\\\'     (3 slashes are converted to 5, first two slashes must be backslashed)
+		  \\\\'  => \\\\\\\'   (4 slashes are converted to 7, first three slashes must be backslashed)
+		  \\\\\' => \\\\\\\\\' (5 slashes are converted to 9, first four slashes must be backslashed)
+	*/
+	return preg_replace( '#(\\\\*)(\\\')#', '$1$1$2', $value );
 }
 
 
 /**
  * Update file /conf/_basic_config.php

Vulnerable code: 	$value = str_replace( array( "'",  "\$" ), array( "\'", "\\$" ), $value );
	return preg_replace( "#([\\\\]*)(\\\\\\\')#", "\\\\\\\\\\\\\\\\\'", $value );
Fixed code: 	// We need backslashes only for single quote(') and backslash(\):
	$value = addcslashes( $value, "'\\" );
	/*
		The below code excludes even number of slashes, because we need always odd
		number of slashes before single quote(') to avoid a broken string value.
		Examples for source and result:
		  \'     => \'         (1 slash is not converted because it is used only for single quote backslashing)
		  \\'    => \\\'       (2 slashes are converted to 3, because only first one slash must be backslashed)
		  \\\'   => \\\\\'     (3 slashes are converted to 5, first two slashes must be backslashed)
		  \\\\'  => \\\\\\\'   (4 slashes are converted to 7, first three slashes must be backslashed)
		  \\\\\' => \\\\\\\\\' (5 slashes are converted to 9, first four slashes must be backslashed)
	*/
	return preg_replace( '#(\\\\*)(\\\')#', '$1$1$2', $value );