CVE-2015-1428: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-02-03T16:59Z
Repository: https://github.com/sefrengo-cms/sefrengo-1.x
Language: PHP
Files changed: backend/external/phplib/local.php
Commit date: 2015-01-13 00:01:43 +0100
Commit message: Escaped strings for session ids and name

Diff: diff --git a/backend/external/phplib/local.php b/backend/external/phplib/local.php
index 4f8349f..0443faa 100644
--- a/backend/external/phplib/local.php
+++ b/backend/external/phplib/local.php
@@ -167,11 +167,11 @@ class DB_cms extends DB_Sql {
 													changed = '" . $now . "',
 													releasetime = '" . $this->cache_time . "'
 													WHERE
 													name = '" . addslashes( $this->cache_name ) . "'
 													AND
-													sid = '" . $this->cache_id . "'";
+													sid = '" . addslashes( $this->cache_id ) . "'";
                     $this->cache_db->query( $sql );
                     break;
             } 
             $this->cache = array();
             $this->cache_id = 0;
@@ -257,13 +257,13 @@ class DB_cms extends DB_Sql {
         if ( $cache_id && $this->use_cache ) {
             if ( !$this->cache_db ) $this->cache_db = new DB_cms;
             $return = false;
             $sql = "SELECT val FROM
 								 " . $cms_db['db_cache'] . " WHERE
-									 name = '" . $this->cache_name . "'
+									 name = '" . addslashes( $this->cache_name ) . "'
 									 AND
-									 sid =  '" . $cache_id . "'";
+									 sid =  '" . addslashes( $cache_id ) . "'";
             if ( !$this->cache_db->query( $sql ) ) return;
             $oldmode = $this->cache_db->get_fetch_mode();
             $this->cache_db->set_fetch_mode( 'DB_FETCH_ASSOC' );
             if( $this->cache_db->next_record() ) {
                 if ( $check ) {
@@ -426,15 +426,15 @@ class cms_CT_Sql extends CT_Sql {
         global $cms_db;
 
         $ret = true;
         $cquery = sprintf("select count(*) from %s where sid='%s' and name='%s'",
             $cms_db['sessions'],
-            $id,
-            $name);
+            addslashes($id),
+            addslashes($name));
         $squery = sprintf("select sid from %s where sid  = '%s' and name = '%s'",
             $cms_db['sessions'],
-            $id,
+            addslashes($id),
             addslashes($name));
         $this->db->query($squery);
         if ( $this->db->affected_rows() == 0
             && $this->db->query($cquery)
 	        && $this->db->next_record() && $this->db->f(0) == 0 ) {
@@ -452,12 +452,12 @@ class cms_CT_Sql extends CT_Sql {
         $sess->gc( true );
 	    if( $id >= 1 && $this->session_enabled ) {
             $this->db->query(sprintf("delete from %s where name = '%s' and sid != '%s' and user_id = '%s'",
                 $cms_db[sessions],
                 addslashes($name),
-                $str,
-                $id));
+                addslashes($str),
+                addslashes($id)));
         }
     }
     function ac_sigleid($name, $id) {
         global $cms_db, $sess;
 
@@ -465,15 +465,15 @@ class cms_CT_Sql extends CT_Sql {
         $ret = true;
         if( $id >= 1 ) {
             $ret = false;
             $cquery = sprintf("select count(*) from %s where user_id='%s' and name='%s'",
                 $cms_db['sessions'],
-                $id,
-                $name);
+                addslashes($id),
+                addslashes($name));
             $squery = sprintf("select sid from %s where user_id='%s' and name='%s'",
                 $cms_db['sessions'],
-                $id,
+                addslashes($id),
                 addslashes($name));
             $this->db->query($squery);
             if ( $this->db->affected_rows() == 0
                 && $this->db->query($cquery)
     	        && $this->db->next_record() && $this->db->f(0) == 0 ) {

Vulnerable code: 													sid = '" . $this->cache_id . "'";
									 name = '" . $this->cache_name . "'
									 sid =  '" . $cache_id . "'";
            $id,
            $name);
            $id,
                $str,
                $id));
                $id,
                $name);
                $id,
Fixed code: 													sid = '" . addslashes( $this->cache_id ) . "'";
									 name = '" . addslashes( $this->cache_name ) . "'
									 sid =  '" . addslashes( $cache_id ) . "'";
            addslashes($id),
            addslashes($name));
            addslashes($id),
                addslashes($str),
                addslashes($id)));
                addslashes($id),
                addslashes($name));
                addslashes($id),