CVE-2015-10063: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in saemorris TheRadSystem and classified as critical. This issue affects the function redirect of the file _login.php. The manipulation of the argument user/pass leads to sql injection. The attack may be initiated remotely. The identifier of the patch is bfba26bd34af31648a11af35a0bb66f1948752a6. It is recommended to apply a patch to fix this issue. The identifier VDB-218453 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-17T19:15Z
Repository: https://github.com/saemorris/TheRadSystem
Language: PHP
Files changed: _login.php, setup.sql, users.php
Commit date: 2015-04-03 18:10:40 -0600
Commit message: Fixed some bugs and SQL injection.

Diff: diff --git a/_login.php b/_login.php
index a91e251..108fedd 100644
--- a/_login.php
+++ b/_login.php
@@ -22,15 +22,16 @@ if (isset($_POST['login'])) {
 	} else {
 		// Require a connection to the database.
 		require ('_database.php');
 		$user = $_POST['user'];
 		$pass = $_POST['pass'];
-		// <-- Bad.
 
-		$query = "SELECT user_name, class, person_id FROM users WHERE user_name = '$user' AND password = '$pass'";
+		$query = "SELECT user_name, class, person_id FROM users WHERE user_name = :username AND password = :password";
 		
 		$statement = oci_parse($connection, $query);
+		oci_bind_by_name($statement, ':username', $user);
+		oci_bind_by_name($statement, ':password', $pass);
 		$results = oci_execute($statement);
 
 		// Did we get a valid result?
 		if ($results) {
 			// Are credentials valid?
diff --git a/setup.sql b/setup.sql
index 3f7f09a..c5c22ef 100644
--- a/setup.sql
+++ b/setup.sql
@@ -9,10 +9,11 @@ DROP TABLE pacs_images;
 DROP TABLE radiology_record;
 DROP TABLE users;
 DROP TABLE persons;
 DROP SEQUENCE record_id_seq;
 DROP SEQUENCE image_id_seq;
+DROP SEQUENCE person_id_seq;
 
 /*
  *  To store the personal information
  */
 CREATE TABLE persons (
diff --git a/users.php b/users.php
index 2247285..39a7cce 100644
--- a/users.php
+++ b/users.php
@@ -10,11 +10,11 @@ requireUserClass('a');
 		<p>
 			<a href="register.php">Add Account</a>
 		</p>
 		<div>
 			<form id="searchform" required="1" name="search_users" method="get" action="<?php $PHP_SELF ?>" >
-				<input type="text" name="q" />
+				<input type="text" name="q" value="<?php echo $_GET['q']; ?>" />
 				<input type="submit" value="Search"  />
 			</form>
 		</div>
 		<div>
 			<?php

Vulnerable code: 		// <-- Bad.
		$query = "SELECT user_name, class, person_id FROM users WHERE user_name = '$user' AND password = '$pass'";
				<input type="text" name="q" />
Fixed code: 		$query = "SELECT user_name, class, person_id FROM users WHERE user_name = :username AND password = :password";
		oci_bind_by_name($statement, ':username', $user);
		oci_bind_by_name($statement, ':password', $pass);
DROP SEQUENCE person_id_seq;
				<input type="text" name="q" value="<?php echo $_GET['q']; ?>" />