CVE-2014-125045: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability has been found in meol1 and classified as critical. Affected by this vulnerability is the function GetAnimal of the file opdracht4/index.php. The manipulation of the argument where leads to sql injection. The identifier of the patch is 82441e413f87920d1e8f866e8ef9d7f353a7c583. It is recommended to apply a patch to fix this issue. The identifier VDB-217525 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-05T22:15Z
Repository: https://github.com/Miesvanderlippe/meol1
Language: PHP
Files changed: opdracht4/index.php
Commit date: 2014-11-24 21:56:42 +0100
Commit message: Opdracht 4 | Fixed SQL injection 3x

Disabled fake prepares
Bindparams for dynamic contents
HEXing of values

This still is injectable on my USBWebserver BTW :/

Diff: diff --git a/opdracht4/index.php b/opdracht4/index.php
index fb2165a..a2df8df 100644
--- a/opdracht4/index.php
+++ b/opdracht4/index.php
@@ -13,13 +13,13 @@ class DB extends PDO {
 	public function __construct($options = Null){
 		
 		if(!isset($options)) {
 
 			$options = array(
-		    
-		    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-		    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
+			    PDO::ATTR_EMULATE_PREPARES => false,
+			    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+			    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
 			);
 		}
 
 		parent::__construct('mysql:host='. $this->dbserver . ';dbname=' . $this->dbname . ';port=' . $this->dbport, $this->dbuser, $this->dbpw, $options);
 	}
@@ -39,15 +39,19 @@ class DB extends PDO {
 
 		$query = 'SELECT `id`, `naam` FROM `meol1_dieren` ';
 
 		//Quickhand if decides wether to filter on name or id based on if the input is numeric. 
 		//Have an animal with a numeric name? Too bad. You could solve this if it weren't for a school excercise.
-		$whereCondition = 'WHERE ' . (is_numeric($where) ? 'id=\''.$where.'\'' : 'naam=\''.$where.'\'');
+		$whereCondition = 'WHERE ' . (is_numeric($where) ? 'id=UNHEX(:where)' : 'naam=UNHEX(:where)');
 
 		$query = $query . $whereCondition . ' LIMIT 1';
 
 		$reponse = parent::prepare($query);
+		$where = bin2hex($where);
+
+		$reponse->bindParam(':where', $where);
+
         $reponse->execute();
         $result	 = $reponse->fetchAll(PDO::FETCH_ASSOC);
 
         return $result;
 	}

Vulnerable code: 		    
		    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
		    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
		$whereCondition = 'WHERE ' . (is_numeric($where) ? 'id=\''.$where.'\'' : 'naam=\''.$where.'\'');
Fixed code: 			    PDO::ATTR_EMULATE_PREPARES => false,
			    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
			    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
		$whereCondition = 'WHERE ' . (is_numeric($where) ? 'id=UNHEX(:where)' : 'naam=UNHEX(:where)');
		$where = bin2hex($where);

		$reponse->bindParam(':where', $where);