CVE-2014-9528: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the from parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks via a request that causes an error.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-01-06T15:59Z
Repository: https://github.com/humhub/humhub
Language: PHP
Files changed: protected/extensions/CmsInput.php, protected/modules_core/admin/controllers/LoggingController.php, protected/modules_core/admin/views/logging/index.php, protected/modules_core/notification/controllers/ListController.php
Commit date: 2014-11-28 14:49:54 +0100
Commit message: Added option to flush log entries

Diff: diff --git a/protected/extensions/CmsInput.php b/protected/extensions/CmsInput.php
index a17ac7d4..f9b795dd 100644
--- a/protected/extensions/CmsInput.php
+++ b/protected/extensions/CmsInput.php
@@ -162,11 +162,11 @@ class CmsInput extends CApplicationComponent
      * @param mixed $str
      * @return
      */
     public function stripClean($str)
     {
-        return $this->xssClean($this->stripTags($str));
+        return $this->stripTags($this->xssClean($str));
     }
     
     /**
      * CmsInput::encode()
      * 
diff --git a/protected/modules_core/admin/controllers/LoggingController.php b/protected/modules_core/admin/controllers/LoggingController.php
index bb2790ad..1942e4c2 100644
--- a/protected/modules_core/admin/controllers/LoggingController.php
+++ b/protected/modules_core/admin/controllers/LoggingController.php
@@ -80,6 +80,13 @@ class LoggingController extends Controller
             'pageSize' => $pageSize,
             'pagination' => $pagination,
         ));
     }
 
+    public function actionFlush()
+    {
+        $this->forcePostRequest();
+        Logging::model()->deleteAll();
+        $this->redirect($this->createUrl('index'));
+    }
+
 }
diff --git a/protected/modules_core/admin/views/logging/index.php b/protected/modules_core/admin/views/logging/index.php
index 8583a249..9584a63d 100644
--- a/protected/modules_core/admin/views/logging/index.php
+++ b/protected/modules_core/admin/views/logging/index.php
@@ -1,16 +1,19 @@
 <div class="panel panel-default">
     <div class="panel-heading"><?php echo Yii::t('AdminModule.views_logging_index', '<strong>Error</strong> logging'); ?></div>
     <div class="panel-body">
 
+        
         <div>
             <?php echo Yii::t('AdminModule.views_logging_index', 'Total {count} entries found.', array("{count}" => $itemCount)); ?>
-            <span
-                class="pull-right"><?php echo Yii::t('AdminModule.views_logging_index', 'Displaying {count} entries per page.', array("{count}" => $pageSize)); ?></span>
+            
+            <span class="pull-right"><?php echo Yii::t('AdminModule.views_logging_index', 'Displaying {count} entries per page.', array("{count}" => $pageSize)); ?></span>
         </div>
 
         <hr>
+        
+        
 
         <ul class="media-list">
             <?php foreach ($entries as $entry) : ?>
 
                 <li class="media">
@@ -26,21 +29,25 @@
                             $labelClass = "label-info";
                         }
                         ?>
 
                         <h4 class="media-heading">
-                            <span class="label <?php echo $labelClass; ?>"><?php echo $entry->level; ?></span>&nbsp;
+                            <span class="label <?php echo $labelClass; ?>"><?php echo CHtml::encode($entry->level); ?></span>&nbsp;
                             <?php echo date('r', $entry->logtime); ?>&nbsp;
-                            <span class="pull-right"><?php echo $entry->category; ?></span>
+                            <span class="pull-right"><?php echo CHtml::encode($entry->category); ?></span>
                         </h4>
-                        <?php echo $entry->message; ?>
+                        <?php echo CHtml::encode($entry->message); ?>
                     </div>
                 </li>
 
             <?php endforeach; ?>
         </ul>
 
+        <?php if ($itemCount != 0): ?>
+            <div class="pull-right"><?php echo HHtml::postLink('Flush entries', array('flush'), array('class'=>'btn btn-danger')); ?></div>
+        <?php endif; ?>
+    
 
         <center>
             <?php
             $this->widget('CLinkPager', array(
                 'currentPage' => $pagination->getCurrentPage(),
diff --git a/protected/modules_core/notification/controllers/ListController.php b/protected/modules_core/notification/controllers/ListController.php
index 8c9ab64e..64f494f2 100644
--- a/protected/modules_core/notification/controllers/ListController.php
+++ b/protected/modules_core/notification/controllers/ListController.php
@@ -41,17 +41,18 @@ class ListController extends Controller
      */
     public function actionIndex()
     {
 
         // the id from the last entry loaded
-        $lastEntryId = Yii::app()->request->getParam('from');
+        $lastEntryId = (int) Yii::app()->request->getParam('from');
 
         // create database query
         $criteria = new CDbCriteria();
         if ($lastEntryId > 0) {
             // start from last entry id loaded
-            $criteria->condition = 'id<' . $lastEntryId;
+            $criteria->condition = 'id<:lastEntryId';
+            $criteria->params = array(':lastEntryId' => $lastEntryId);
         }
         $criteria->order = 'seen ASC, created_at DESC';
         $criteria->limit = 6;
 
         // safe query

Vulnerable code:         return $this->xssClean($this->stripTags($str));
            <span
                class="pull-right"><?php echo Yii::t('AdminModule.views_logging_index', 'Displaying {count} entries per page.', array("{count}" => $pageSize)); ?></span>
                            <span class="label <?php echo $labelClass; ?>"><?php echo $entry->level; ?></span>&nbsp;
                            <span class="pull-right"><?php echo $entry->category; ?></span>
                        <?php echo $entry->message; ?>
        $lastEntryId = Yii::app()->request->getParam('from');
            $criteria->condition = 'id<' . $lastEntryId;
Fixed code:         return $this->stripTags($this->xssClean($str));
    public function actionFlush()
    {
        $this->forcePostRequest();
        Logging::model()->deleteAll();
        $this->redirect($this->createUrl('index'));
    }

        
            
            <span class="pull-right"><?php echo Yii::t('AdminModule.views_logging_index', 'Displaying {count} entries per page.', array("{count}" => $pageSize)); ?></span>
        
        
                            <span class="label <?php echo $labelClass; ?>"><?php echo CHtml::encode($entry->level); ?></span>&nbsp;
                            <span class="pull-right"><?php echo CHtml::encode($entry->category); ?></span>
                        <?php echo CHtml::encode($entry->message); ?>
        <?php if ($itemCount != 0): ?>
            <div class="pull-right"><?php echo HHtml::postLink('Flush entries', array('flush'), array('class'=>'btn btn-danger')); ?></div>
        <?php endif; ?>
    
        $lastEntryId = (int) Yii::app()->request->getParam('from');
            $criteria->condition = 'id<:lastEntryId';
            $criteria->params = array(':lastEntryId' => $lastEntryId);