CVE-2022-31082: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2022-06-27T21:15Z
Repository: https://github.com/glpi-project/glpi-inventory-plugin
Language: PHP
Files changed: inc/deploypackage.class.php
Commit date: 2022-06-20 09:06:12 +0200
Commit message: Merge pull request from GHSA-q6m7-h6rj-5wmw


Diff: diff --git a/inc/deploypackage.class.php b/inc/deploypackage.class.php
index ac1e81809..5549956e7 100644
--- a/inc/deploypackage.class.php
+++ b/inc/deploypackage.class.php
@@ -33,10 +33,12 @@
 
 if (!defined('GLPI_ROOT')) {
     die("Sorry. You can't access directly to this file");
 }
 
+use Glpi\Toolbox\Sanitizer;
+
 /**
  * Manage the deploy packages.
  */
 class PluginGlpiinventoryDeployPackage extends CommonDBTM
 {
@@ -1887,15 +1889,15 @@ class PluginGlpiinventoryDeployPackage extends CommonDBTM
            // case 2: if not exist, create a new task + taskjob
             $this->getFromDB($packages_id);
 
            //Add the new task
             $input = [
-            'name'                    => '[deploy on demand] ' . $this->fields['name'],
-            'entities_id'             => $computer->fields['entities_id'],
-            'reprepare_if_successful' => 0,
-            'is_deploy_on_demand'     => 1,
-            'is_active'               => 1,
+                'name'                    => '[deploy on demand] ' . Sanitizer::dbEscape($this->fields['name']),
+                'entities_id'             => $computer->fields['entities_id'],
+                'reprepare_if_successful' => 0,
+                'is_deploy_on_demand'     => 1,
+                'is_active'               => 1,
             ];
             $tasks_id = $pfTask->add($input);
 
            //Add a new job for the newly created task
            //and enable it

Vulnerable code:             'name'                    => '[deploy on demand] ' . $this->fields['name'],
            'entities_id'             => $computer->fields['entities_id'],
            'reprepare_if_successful' => 0,
            'is_deploy_on_demand'     => 1,
            'is_active'               => 1,
Fixed code: use Glpi\Toolbox\Sanitizer;

                'name'                    => '[deploy on demand] ' . Sanitizer::dbEscape($this->fields['name']),
                'entities_id'             => $computer->fields['entities_id'],
                'reprepare_if_successful' => 0,
                'is_deploy_on_demand'     => 1,
                'is_active'               => 1,