CVE-2014-125063: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in ada-l0velace Bid and classified as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is abd71140b8219fa8741d0d8a57ab27d5bfd34222. It is recommended to apply a patch to fix this issue. The identifier VDB-217625 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-07T19:15Z
Repository: https://github.com/ada-l0velace/Bid
Language: PHP
Files changed: js/ajax_forms.js, lance.php, leilao.php
Commit date: 2014-12-03 20:38:27 +0000
Commit message: sql injection problems solved

Diff: diff --git a/js/ajax_forms.js b/js/ajax_forms.js
index 4f496ad..6afb868 100644
--- a/js/ajax_forms.js
+++ b/js/ajax_forms.js
@@ -40,16 +40,18 @@ $(document).ready(function(){
 			url: "lance.php",
 			type: "post",
 			data: values,
 			success: function(data){
 				try {
+					//alert(data);
 					var error = $(data).filter("#erro");
 					//var error = $(data).find('#erro'); use this if div is nested
-					alert(error.html());
+					if(error.html() != undefined)
+						alert(error.html());
 				}
 				catch(err) {
-					//console.log("Error not found");
+					console.log("Error not found");
 				}
 				populateDivTable("leilaoinscritos.php","leiloesincritos");
 				populateDivTable("leilaotop.php","leiloestop");
 			},
 			error:function(){
diff --git a/lance.php b/lance.php
index 2affb67..053353d 100755
--- a/lance.php
+++ b/lance.php
@@ -19,34 +19,44 @@
 	if ($_SERVER["REQUEST_METHOD"] == "POST") {
 	 $lid = test_input($_POST["lid"]);
 	 $lance = test_input($_POST["lance"]);
 	 } 
 
-	$ultimolance_query="SELECT MAX(lance.valor) AS max_valor 
+	/*$ultimolance_query="SELECT MAX(lance.valor) AS max_valor 
 	                    FROM lance 
 	                    WHERE lance.leilao = $lid";
-	$ultimolance = $connection->query($ultimolance_query);
+	$ultimolance = $connection->query($ultimolance_query);*/
+	$ultimolance = $connection->prepare("SELECT MAX(lance.valor) AS max_valor 
+	                    FROM lance 
+	                    WHERE lance.leilao = :lid");
+	$ultimolance->bindParam(':lid', $lid);
+	$ultimolance->setFetchMode(PDO::FETCH_ASSOC);
+	$ultimolance->execute();
 	$teste = false;
+	$ultimolance = $ultimolance->fetchAll();
 	foreach($ultimolance as $row){
 		if($row['max_valor'] == ""){
 			$teste = true;
 			echo("<p>");
 			echo("testes");
 			echo("<p>");
 		}
 
 	}
-	$ultimolance = $connection->query($ultimolance_query);
-
+	
+	//$ultimolance = $connection->query($ultimolance_query);
+	
 	if($teste == true){
 		$valorbase_query="SELECT valorbase AS min_valor 
 						  FROM leilaor, leilao 
-						  WHERE leilaor.lid = $lid 
+						  WHERE leilaor.lid = :lid 
 						  AND leilaor.dia = leilao.dia 
 						  AND leilaor.nrleilaonodia = leilao.nrleilaonodia 
 						  AND leilaor.nif = leilao.nif";
-		$valorbase = $connection->query($valorbase_query);
+		$valorbase = $connection->prepare($valorbase_query);
+		$valorbase->bindParam(':lid', $lid);
+		$valorbase->execute();
 		foreach($valorbase as $row){
 			$valor_min = $row["min_valor"];
 		}
 		$valor_max = 0;
 	}else{
@@ -57,16 +67,16 @@
 	}
 
 	if($valor_max < $lance and $valor_min <= $lance){
 		$lance_query="INSERT INTO lance(pessoa,leilao,valor) 
 					  VALUES ($nif,$lid,$lance)";
-		$result = $connection->query($lance_query);
-		
-		echo($lance_query);
+		$result = $connection->prepare($lance_query);
+		$error = $result->execute();
+		//echo($lance_query);
 		
-		if (!$result) {
-	 		echo("<div id='erro'> Não houve lance:($sql) </div>");
+		if (!$error) {
+	 		echo("<div id='erro'> Não houve lance:($error) </div>");
 		}
 	}else{
 		echo("<div id='erro'> O valor do lance é inválido </div>");
 	}
 	?>
\ No newline at end of file
diff --git a/leilao.php b/leilao.php
index f616bba..7ce4303 100755
--- a/leilao.php
+++ b/leilao.php
@@ -22,35 +22,34 @@
 	if(!$lid){
 		echo("<div id='erro'> Leilão não existe! </div>");
 		exit();
 	}
 
-	//regista a pessoa no leilão. Exemplificativo apenas.....
-	$inscreve_query = "INSERT INTO concorrente (pessoa,leilao) 
-				       VALUES ($nif,$lid)";
+	
 	$data_now = date("y-m-d");
 
 	/*
 	echo("<p>");
 	echo($lid);
 	echo("</p>");
 	*/
 
 	/* PREPARED STATEMENTS */
 	$sqlDataLeilao = "SELECT * FROM leilaor 
-					  WHERE lid =" . $lid;
-	$resultado = $connection->query($sqlDataLeilao);
-
+					  WHERE lid =:lid";
+	$resultado = $connection->prepare($sqlDataLeilao);
+	$resultado->bindParam(':lid', $lid);
+	$error = $resultado->execute();
 	/*
 	echo("<p>");
 	echo($sqlDataLeilao);
 	echo("</p>");
 	*/
 
 
-	if (!$resultado) {
-		echo("<p> Erro na Query:($sql) </p>");
+	if (!$error) {
+		echo("<div id='erro'> Erro na Query:($sql) </div>");
 		exit();
 	}
 
 	foreach($resultado as $row){
 		$time_leilao = strtotime($row["dia"]) ;
@@ -69,14 +68,21 @@
 	$datediff = strtotime($new_dia) - strtotime($data_now);
 	echo floor($datediff/(60*60*24));
 	echo("</p>");
 */
 	$datediff = strtotime($new_dia) - strtotime($data_now);
+
+	//regista a pessoa no leilão. Exemplificativo apenas.....
+	$inscreve_query = "INSERT INTO concorrente (pessoa,leilao) 
+				       VALUES (:nif,:lid)";
 	if($data_now <= $new_dia){
 		if($dia_abertura <= $data_now){
-			$inscreve = $connection->query($inscreve_query);
-			if (!$inscreve) {
+			$inscreve = $connection->prepare($inscreve_query);
+			$inscreve->bindParam(':nif', $nif);
+			$inscreve->bindParam(':lid', $lid);
+			$error = $inscreve->execute();
+			if (!$error) {
 			 	echo("<div id='erro'> Pessoa já se encontra registada neste leilão! </div>");
 				exit();
 			}
 			echo("<div id='erro'> Pessoa ($username), nif ($nif) Registada no leilao ($lid)</div>\n");
 		}else{

Vulnerable code: 					alert(error.html());
					//console.log("Error not found");
	$ultimolance_query="SELECT MAX(lance.valor) AS max_valor 
	$ultimolance = $connection->query($ultimolance_query);
	$ultimolance = $connection->query($ultimolance_query);

						  WHERE leilaor.lid = $lid 
		$valorbase = $connection->query($valorbase_query);
		$result = $connection->query($lance_query);
		
		echo($lance_query);
		if (!$result) {
	 		echo("<div id='erro'> Não houve lance:($sql) </div>");
	//regista a pessoa no leilão. Exemplificativo apenas.....
	$inscreve_query = "INSERT INTO concorrente (pessoa,leilao) 
				       VALUES ($nif,$lid)";
					  WHERE lid =" . $lid;
	$resultado = $connection->query($sqlDataLeilao);

	if (!$resultado) {
		echo("<p> Erro na Query:($sql) </p>");
			$inscreve = $connection->query($inscreve_query);
			if (!$inscreve) {
Fixed code: 					//alert(data);
					if(error.html() != undefined)
						alert(error.html());
					console.log("Error not found");
	/*$ultimolance_query="SELECT MAX(lance.valor) AS max_valor 
	$ultimolance = $connection->query($ultimolance_query);*/
	$ultimolance = $connection->prepare("SELECT MAX(lance.valor) AS max_valor 
	                    FROM lance 
	                    WHERE lance.leilao = :lid");
	$ultimolance->bindParam(':lid', $lid);
	$ultimolance->setFetchMode(PDO::FETCH_ASSOC);
	$ultimolance->execute();
	$ultimolance = $ultimolance->fetchAll();
	
	//$ultimolance = $connection->query($ultimolance_query);
	
						  WHERE leilaor.lid = :lid 
		$valorbase = $connection->prepare($valorbase_query);
		$valorbase->bindParam(':lid', $lid);
		$valorbase->execute();
		$result = $connection->prepare($lance_query);
		$error = $result->execute();
		//echo($lance_query);
		if (!$error) {
	 		echo("<div id='erro'> Não houve lance:($error) </div>");
	
					  WHERE lid =:lid";
	$resultado = $connection->prepare($sqlDataLeilao);
	$resultado->bindParam(':lid', $lid);
	$error = $resultado->execute();
	if (!$error) {
		echo("<div id='erro'> Erro na Query:($sql) </div>");

	//regista a pessoa no leilão. Exemplificativo apenas.....
	$inscreve_query = "INSERT INTO concorrente (pessoa,leilao) 
				       VALUES (:nif,:lid)";
			$inscreve = $connection->prepare($inscreve_query);
			$inscreve->bindParam(':nif', $nif);
			$inscreve->bindParam(':lid', $lid);
			$error = $inscreve->execute();
			if (!$error) {