CVE-2015-10091: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability has been found in ByWater Solutions bywater-koha-xslt and classified as critical. This vulnerability affects the function StringSearch of the file admin/systempreferences.pl. The manipulation of the argument name leads to sql injection. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 9513b93c828dfbc4413f9e0df63647401aaf4e58. It is recommended to apply a patch to fix this issue. VDB-222322 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.2
Published: 2023-03-06T04:15Z
Repository: https://github.com/bywatersolutions/bywater-koha-xslt
Language: Perl
Files changed: admin/systempreferences.pl
Commit date: 2015-07-21 16:06:37 +1200
Commit message: Bug 14521: SQL injection in local use system preferences

This patch fixes a SQL injection vulnerability in the local use
system preferences.

_TEST PLAN_

Before applying:

1) Go to Global System Preferences
2) Click on the "Local use" tab
3) Add a new preference with the value "') or '1' = '1' -- "
(be sure to include the space at the end after the comment --).
4) When the page refreshes, you should now see about 99 other system
preferences which shouldn't be showing up.

5) Apply the patch

6) Refresh the page
7) Note that you now only see a system preference for "') or '1' = '1' -- "
and the other actual local use system preferences.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
(cherry picked from commit a72262a950aa701cebe460e2a3a7586edecd86be)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Liz Rea <wizzyrea@gmail.com>

Diff: diff --git a/admin/systempreferences.pl b/admin/systempreferences.pl
index c55ab4ccb..ab10a4de3 100755
--- a/admin/systempreferences.pl
+++ b/admin/systempreferences.pl
@@ -68,18 +68,20 @@ sub StringSearch {
     my $cnt = 0;
     my $sth;
 
     my $strsth = "Select variable,value,explanation,type,options from systempreferences where variable in (";
     my $first = 1;
+    my @sql_bind;
     for my $name ( get_local_prefs() ) {
                 $strsth .= ',' unless $first;
-                $strsth .= "'$name'";
+                $strsth .= "?";
+                push(@sql_bind,$name);
                 $first = 0;
     }
     $strsth .= ") order by variable";
     $sth = $dbh->prepare($strsth);
-    $sth->execute();
+    $sth->execute(@sql_bind);
 
     while ( my $data = $sth->fetchrow_hashref ) {
             unless (defined $data->{value}) { $data->{value} = "";}
             $data->{shortvalue} = $data->{value};
             $data->{shortvalue} = substr( $data->{value}, 0, 60 ) . "..." if length( $data->{value} ) > 60;

Vulnerable code:                 $strsth .= "'$name'";
    $sth->execute();
Fixed code:     my @sql_bind;
                $strsth .= "?";
                push(@sql_bind,$name);
    $sth->execute(@sql_bind);