CVE-2012-10009: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is the function checkPage of the file 404Like.php. The manipulation of the argument searchWord leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 2c4b589d27554910ab1fd104ddbec9331b540f7f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223404.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-03-21T00:15Z
Repository: https://github.com/wp-plugins/404like
Language: Other
Files changed: 404Like.php, readme.txt
Commit date: 2012-02-11 22:24:01 +0000
Commit message: Check for sql injection by '";
Plugin work automatic without code in 404 template

git-svn-id: https://plugins.svn.wordpress.org/404like/trunk@503776 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/404Like.php b/404Like.php
index ce14466..014c5a7 100644
--- a/404Like.php
+++ b/404Like.php
@@ -1,11 +1,11 @@
 <?php
 /*
  Plugin Name: 404Like
  Plugin URI: http://www.gnetos.de/projekte/404Like
  Description: Es wird keine 404 Fehlermeldung ausgegeben, sondern nach ähnlichen Seiten gesucht und auf eventuelle Treffer weitergeleitet oder eine Liste möglicher Treffer ausgegeben / It is not issued any 404 error message, but looking for similar sites and forwarded to any results or output a list of possible matches
- Version: 1.0
+ Version: 1.0.2
  Author: Tobias Gafner
  Author URI: http://www.gnetos.de
  License: GPL2
  */
 
@@ -26,20 +26,22 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 */
 /**
  * Search function
  */ 
 function findPostWhereLikeNameTitle($title = "") {
+	$title = strtolower($title);
 	$where .= " (post_type = 'post' OR post_type = 'page') AND
-    post_status = 'publish' AND (post_name like '%".$title."%' OR post_title like '%".$title."%')";
+    post_status = 'publish' AND (LOWER(post_name) like '%".$title."%' OR post_title like '%".$title."%')";
 	return $where;
 }
 /**
  * Search function
  */ 
 function findPostWhereLike($title = "") {
+	$title = strtolower($title);
 	$where = " (post_type = 'post' OR post_type = 'page') AND
-    post_status = 'publish' AND (post_title like '%".$title."%')";
+    post_status = 'publish' AND (LOWER(post_title) like '%".$title."%')";
 	return $where;
 }
 /**
  *  this function must call in your 404 Page
  *  
@@ -50,34 +52,44 @@ function findPostWhereLike($title = "") {
     .....
  *
  */  
 function checkPage() {
 	global $wpdb;
+	
+	if ( !is_404() )
+	return;
 
   $urltext =  $_SERVER['REQUEST_URI'];
 	//$urltexta = substr($urltext,1);
 	$urltext = trim($urltext);
   //Letztes / loeschen
+  //schuetzen
   $urltext = htmlspecialchars($urltext); 
   if(strlen($urltext) != 0)   {
     //Letztes Zeichen ist ?
     if(substr ($urltext , -1,1) == "/") {
       $urltext = substr ($urltext , 0,-1);
     }
     //Letztes von xxx/xxxx/xxx ist interessant
     $searchWord = 	substr (strrchr ($urltext, "/"), 1);
     //SQL 
+    $searchWord = stripslashes($searchWord);
+    $searchWord = str_replace ("'", "", $searchWord);
+    $searchWord = str_replace ('"', "", $searchWord);
+    $searchWord = str_replace (';', "", $searchWord);
     $querystr = "SELECT * FROM $wpdb->posts WHERE ".findPostWhereLike($searchWord);
     $pageposts = $wpdb->get_col($querystr);
     if ($pageposts) {
       ob_start();
-  		if (count($pageposts) == 1) { 
+      
+  		if (count($pageposts) == 1 || ($searchWord == "404Like" || $searchWord == "404like")) { 
       	foreach ($pageposts as $id) {
           $url = get_permalink($id); 
           echo $inhalt;
           wp_redirect($url,301);
           // Okay, stop.
+          break;
         }         
         
         wp_reset_query();               
         ob_end_flush();     
   		}
@@ -110,11 +122,11 @@ function new404ErrorPage() {
     //SQL
     $querystr = "SELECT *  FROM $wpdb->posts WHERE ".findPostWhereLikeNameTitle($searchWord);   
     $pageposts = $wpdb->get_col($querystr);
     if ($pageposts) {
     //Ausgabe
-      echo '<div id="errorresults"><h2 class="twost">Folgendes Gesucht ?</h2><ul>';
+      echo '<div id="errorresults"><h2 class="twost">'.__("Folgendes Gesucht").' ?</h2><ul>';
     	foreach ($pageposts as $id) {
         $post_id_7 = get_post($id);
         $url = get_permalink($id);  
         $title = $post_id_7->post_title;
         echo "<li>".'<a href="'.$url.'">'.$title."</a></li>";
@@ -123,6 +135,15 @@ function new404ErrorPage() {
     }
   	//Reset Query
   	wp_reset_query();
 	}
 }
+
+function plugin404Like_filter($redirect, $request) {
+
+	if ( is_404() ) {return false;}
+	return $redirect;
+}
+
+add_action( 'template_redirect', 'checkPage' );
+add_filter( 'redirect_canonical', 'plugin404Like_filter', 10, 2 );
 ?>
\ No newline at end of file
diff --git a/readme.txt b/readme.txt
index a80b850..388e0e1 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,11 +1,11 @@
 === Plugin Name ===
 Contributors: tobig
 Donate link: http://www.gnetos.de
 Tags: 404, not found
 Requires at least: 2.7.0
-Tested up to: 3.0
+Tested up to: 3.3.0
 Stable tag: trunk
 
 It is not issued any 404 error message, but looking for similar sites and forwarded to any results or output a list of possible matches
 
 == Description ==
@@ -14,7 +14,7 @@ It is not issued any 404 error message, but looking for similar sites and forwar
 
 == Installation ==
 
 1. Upload `404Like.php` to the `/wp-content/plugins/` directory
 2. Activate the plugin through the 'Plugins' menu in WordPress
-3. Place `<?php checkPage(); ? >` in first line of your 404 template page.
+3. Nothing, it works without any other activities - you can test it
 4. Optional add < ? php new404ErrorPage(); ? >  to your 404 template page.
\ No newline at end of file

Vulnerable code:  Version: 1.0
    post_status = 'publish' AND (post_name like '%".$title."%' OR post_title like '%".$title."%')";
    post_status = 'publish' AND (post_title like '%".$title."%')";
  		if (count($pageposts) == 1) { 
      echo '<div id="errorresults"><h2 class="twost">Folgendes Gesucht ?</h2><ul>';
Tested up to: 3.0
3. Place `<?php checkPage(); ? >` in first line of your 404 template page.
Fixed code:  Version: 1.0.2
	$title = strtolower($title);
    post_status = 'publish' AND (LOWER(post_name) like '%".$title."%' OR post_title like '%".$title."%')";
	$title = strtolower($title);
    post_status = 'publish' AND (LOWER(post_title) like '%".$title."%')";
	
	if ( !is_404() )
	return;
  //schuetzen
    $searchWord = stripslashes($searchWord);
    $searchWord = str_replace ("'", "", $searchWord);
    $searchWord = str_replace ('"', "", $searchWord);
    $searchWord = str_replace (';', "", $searchWord);
      
  		if (count($pageposts) == 1 || ($searchWord == "404Like" || $searchWord == "404like")) { 
          break;
      echo '<div id="errorresults"><h2 class="twost">'.__("Folgendes Gesucht").' ?</h2><ul>';

function plugin404Like_filter($redirect, $request) {

	if ( is_404() ) {return false;}
	return $redirect;
}

add_action( 'template_redirect', 'checkPage' );
add_filter( 'redirect_canonical', 'plugin404Like_filter', 10, 2 );
Tested up to: 3.3.0
3. Nothing, it works without any other activities - you can test it