CVE-2021-24666: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P<id>[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2021-09-27T16:15Z
Repository: https://github.com/podlove/podlove-publisher
Language: PHP
Files changed: lib/modules/social/model/contributor_service.php, lib/modules/social/model/show_service.php, readme.txt
Commit date: 2021-08-22 11:31:50 +0200
Commit message: fix(security): sql injection in "Social & Donations" module

Diff: diff --git a/lib/modules/social/model/contributor_service.php b/lib/modules/social/model/contributor_service.php
index c4784b02..7cc81679 100644
--- a/lib/modules/social/model/contributor_service.php
+++ b/lib/modules/social/model/contributor_service.php
@@ -49,10 +49,13 @@ class ContributorService extends Base
         return str_replace('%account-placeholder%', $this->value, $service->url_scheme);
     }
 
     public static function find_by_contributor_id_and_category($contributor_id, $category = 'social')
     {
+        $contributor_id = (int) $contributor_id;
+        $category = $category == 'social' ? 'social' : 'donation';
+
         return self::all('WHERE service_id IN (SELECT id FROM '.Service::table_name()." WHERE `category` = '".$category."' ) AND `contributor_id` = ".$contributor_id);
     }
 }
 
 ContributorService::property('id', 'INT NOT NULL AUTO_INCREMENT PRIMARY KEY');
diff --git a/lib/modules/social/model/show_service.php b/lib/modules/social/model/show_service.php
index 52943e75..2ab84725 100644
--- a/lib/modules/social/model/show_service.php
+++ b/lib/modules/social/model/show_service.php
@@ -30,10 +30,12 @@ class ShowService extends Base
         return str_replace('%account-placeholder%', $this->value, $service->url_scheme);
     }
 
     public static function find_by_category($category = 'social')
     {
+        $category = $category == 'social' ? 'social' : 'donation';
+
         return self::all('WHERE service_id IN (SELECT id FROM '.Service::table_name()." WHERE `category` = '".$category."' ) ORDER BY position ASC");
     }
 }
 
 ShowService::property('id', 'INT NOT NULL AUTO_INCREMENT PRIMARY KEY');
diff --git a/readme.txt b/readme.txt
index 209cb07b..4e8b243d 100644
--- a/readme.txt
+++ b/readme.txt
@@ -104,10 +104,14 @@ This product includes GeoLite2 data created by MaxMind, available from http://ww
 5. Includes the Podlove Subscribe Button, the easiest way for listeners to subscribe to your podcast.
 6. Includes the Podlove Web Player. One more thing: you can manage and present all contributors easily.
 
 == Changelog ==
 
+= 2021-08-22 =
+
+* fix(security): sql injection in "Social & Donations" module
+
 = 2021-05-02 =
 
 * fix: transcript API returns list again
 
 = 2021-05-01 =

Fixed code:         $contributor_id = (int) $contributor_id;
        $category = $category == 'social' ? 'social' : 'donation';

        $category = $category == 'social' ? 'social' : 'donation';

= 2021-08-22 =

* fix(security): sql injection in "Social & Donations" module