CVE-2022-31137: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Attackers need not be authenticated to exploit this vulnerability. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2022-07-08T20:15Z
Repository: https://github.com/hap-wi/roxy-wi
Language: Python
Files changed: app/options.py
Commit date: 2022-07-08 20:43:13 +0300
Commit message: v6.1.1.0

Change log: https://roxy-wi.org/changelog.py#6_1_1

Diff: diff --git a/app/options.py b/app/options.py
index 5152756..728a4cf 100644
--- a/app/options.py
+++ b/app/options.py
@@ -59,27 +59,22 @@ if form.getvalue('checkSshConnect') is not None and serv is not None:
         print(funct.ssh_command(serv, ["ls -1t"]))
     except Exception as e:
         print(e)
 
 if form.getvalue('getcert') is not None and serv is not None:
-    cert_id = form.getvalue('getcert')
-    if funct.checkAjaxInput(cert_id):
-        print('error: Nice try')
-        sys.exit()
+    cert_id = funct.checkAjaxInput(form.getvalue('getcert'))
 
     cert_path = sql.get_setting('cert_path')
     commands = ["openssl x509 -in " + cert_path + "/" + cert_id + " -text"]
     try:
         funct.ssh_command(serv, commands, ip="1")
     except Exception as e:
         print('error: Cannot connect to the server ' + e.args[0])
 
 if form.getvalue('delcert') is not None and serv is not None:
-    if funct.checkAjaxInput(cert_id):
-        print('error: Nice try')
-        sys.exit()
-
+    cert_id = form.getvalue('delcert')
+    cert_id = funct.checkAjaxInput(cert_id)
     cert_path = sql.get_setting('cert_path')
     commands = ["sudo rm -f " + cert_path + "/" + cert_id]
     try:
         funct.ssh_command(serv, commands, ip="1")
     except Exception as e:
@@ -94,14 +89,11 @@ if serv and form.getvalue('ssl_cert'):
         os.makedirs(cert_local_dir)
 
     if form.getvalue('ssl_name') is None:
         print('error: Please enter a desired name')
     else:
-        name = form.getvalue('ssl_name')
-        if funct.checkAjaxInput(name):
-            print('error: Nice try')
-            sys.exit()
+        name = funct.checkAjaxInput(form.getvalue('ssl_name'))
 
     try:
         with open(name, "w") as ssl_cert:
             ssl_cert.write(form.getvalue('ssl_cert'))
     except IOError as e:
@@ -130,41 +122,33 @@ if form.getvalue('backend') is not None:
 if form.getvalue('ip_select') is not None:
     funct.show_backends(serv)
 
 if form.getvalue('ipbackend') is not None and form.getvalue('backend_server') is None:
     haproxy_sock_port = int(sql.get_setting('haproxy_sock_port'))
-    backend = form.getvalue('ipbackend')
-    if funct.checkAjaxInput(backend):
-        print('error: Nice try')
-        sys.exit()
+    backend = funct.checkAjaxInput(form.getvalue('ipbackend'))
     cmd = 'echo "show servers state"|nc %s %s |grep "%s" |awk \'{print $4}\'' % (serv, haproxy_sock_port, backend)
     output, stderr = funct.subprocess_execute(cmd)
     for i in output:
         if i == ' ':
             continue
         i = i.strip()
         print(i + '<br>')
 
 if form.getvalue('ipbackend') is not None and form.getvalue('backend_server') is not None:
     haproxy_sock_port = int(sql.get_setting('haproxy_sock_port'))
-    backend = form.getvalue('ipbackend')
-    backend_server = form.getvalue('backend_server')
-    if funct.checkAjaxInput(backend) or funct.checkAjaxInput(backend_server):
-        print('error: Nice try')
-        sys.exit()
+    backend = funct.checkAjaxInput(form.getvalue('ipbackend'))
+    backend_server = funct.checkAjaxInput(form.getvalue('backend_server'))
     cmd = 'echo "show servers state"|nc %s %s |grep "%s" |grep "%s" |awk \'{print $5":"$19}\' |head -1' % (serv, haproxy_sock_port, backend, backend_server)
     output, stderr = funct.subprocess_execute(cmd)
     print(output[0])
 
 if form.getvalue('backend_ip') is not None:
-    backend_backend = form.getvalue('backend_backend')
-    backend_server = form.getvalue('backend_server')
-    backend_ip = form.getvalue('backend_ip')
-    backend_port = form.getvalue('backend_port')
-    if any((funct.checkAjaxInput(backend_backend), funct.checkAjaxInput(backend_server), funct.checkAjaxInput(backend_ip), funct.checkAjaxInput(backend_port))):
-        print('error: Nice try')
-        sys.exit()
+    backend_backend = funct.checkAjaxInput(form.getvalue('backend_backend'))
+    backend_server = funct.checkAjaxInput(form.getvalue('backend_server'))
+    backend_ip = funct.checkAjaxInput(form.getvalue('backend_ip'))
+    backend_port = funct.checkAjaxInput(form.getvalue('backend_port'))
+
     if form.getvalue('backend_ip') is None:
         print('error: Backend IP must be IP and not 0')
         sys.exit()
 
     if form.getvalue('backend_port') is None:
@@ -209,23 +193,17 @@ if form.getvalue('backend_ip') is not None:
               (backend_backend, cfg, backend_server, backend_ip, backend_port, cfg)
         output, stderr = funct.subprocess_execute(cmd)
         stderr = funct.master_slave_upload_and_restart(serv, cfg, just_save='save')
 
 if form.getvalue('maxconn_select') is not None:
-    serv = form.getvalue('maxconn_select')
-    if funct.checkAjaxInput(serv):
-        print('error: Nice try')
-        sys.exit()
+    serv = funct.checkAjaxInput(form.getvalue('maxconn_select'))
     funct.get_backends_from_config(serv, backends='frontend')
 
 if form.getvalue('maxconn_frontend') is not None:
-    frontend = form.getvalue('maxconn_frontend')
-    maxconn = form.getvalue('maxconn_int')
+    frontend = funct.checkAjaxInput(form.getvalue('maxconn_frontend'))
+    maxconn = funct.checkAjaxInput(form.getvalue('maxconn_int'))
 
-    if funct.checkAjaxInput(frontend) or funct.checkAjaxInput(maxconn):
-        print('error: Nice try')
-        sys.exit()
     if form.getvalue('maxconn_int') is None:
         print('error: Maxconn must be integer and not 0')
         sys.exit()
 
     haproxy_sock_port = sql.get_setting('haproxy_sock_port')
@@ -295,29 +273,21 @@ if form.getvalue('table_select') is not None:
 
     print(template)
 
 if form.getvalue('ip_for_delete') is not None:
     haproxy_sock_port = sql.get_setting('haproxy_sock_port')
-    ip = form.getvalue('ip_for_delete')
-    table = form.getvalue('table_for_delete')
-
-    if funct.checkAjaxInput(ip) or funct.checkAjaxInput(table):
-        print('error: Nice try')
-        sys.exit()
+    ip = funct.checkAjaxInput(form.getvalue('ip_for_delete'))
+    table = funct.checkAjaxInput(form.getvalue('table_for_delete'))
 
     cmd = 'echo "clear table %s key %s" |nc %s %s' % (table, ip, serv, haproxy_sock_port)
     output, stderr = funct.subprocess_execute(cmd)
     if stderr[0] != '':
         print('error: ' + stderr[0])
 
 if form.getvalue('table_for_clear') is not None:
     haproxy_sock_port = sql.get_setting('haproxy_sock_port')
-    table = form.getvalue('table_for_clear')
-
-    if funct.checkAjaxInput(table):
-        print('error: Nice try')
-        sys.exit()
+    table = funct.checkAjaxInput(form.getvalue('table_for_clear'))
 
     cmd = 'echo "clear table %s " |nc %s %s' % (table, serv, haproxy_sock_port)
     output, stderr = funct.subprocess_execute(cmd)
     if stderr[0] != '':
         print('error: ' + stderr[0])
@@ -332,16 +302,12 @@ if form.getvalue('list_select_id') is not None:
     from jinja2 import Environment, FileSystemLoader
 
     env = Environment(loader=FileSystemLoader('templates/'), autoescape=True,
                       extensions=['jinja2.ext.loopcontrols', 'jinja2.ext.do'], trim_blocks=True, lstrip_blocks=True)
     template = env.get_template('ajax/list.html')
-    list_id = form.getvalue('list_select_id')
-    list_name = form.getvalue('list_select_name')
-
-    if funct.checkAjaxInput(list_id) or funct.checkAjaxInput(list_name):
-        print('error: Nice try')
-        sys.exit()
+    list_id = funct.checkAjaxInput(form.getvalue('list_select_id'))
+    list_name = funct.checkAjaxInput(form.getvalue('list_select_name'))
 
     haproxy_sock_port = sql.get_setting('haproxy_sock_port')
     cmd = 'echo "show acl #%s"|nc %s %s' % (list_id, serv, haproxy_sock_port)
     output, stderr = funct.subprocess_execute(cmd)
 
@@ -349,21 +315,16 @@ if form.getvalue('list_select_id') is not None:
     print(template)
 
 if form.getvalue('list_id_for_delete') is not None:
     haproxy_sock_port = sql.get_setting('haproxy_sock_port')
     lists_path = sql.get_setting('lists_path')
-    lib_path = funct.get_config_var('main', 'lib_path')
-    ip_id = form.getvalue('list_ip_id_for_delete')
-    ip = form.getvalue('list_ip_for_delete')
-    list_id = form.getvalue('list_id_for_delete')
-    list_name = form.getvalue('list_name')
-    user_group = funct.get_user_group(id=1)
-
-    if any((funct.checkAjaxInput(ip_id), funct.checkAjaxInput(ip), funct.checkAjaxInput(list_id), funct.checkAjaxInput(list_name))):
-        print('error: Nice try')
-        sys.exit()
-
+    lib_path = funct.checkAjaxInput(funct.get_config_var('main', 'lib_path'))
+    ip_id = funct.checkAjaxInput(form.getvalue('list_ip_id_for_delete'))
+    ip = funct.checkAjaxInput(form.getvalue('list_ip_for_delete'))
+    list_id = funct.checkAjaxInput(form.getvalue('list_id_for_delete'))
+    list_name = funct.checkAjaxInput(form.getvalue('list_name'))
+    user_group = funct.checkAjaxInput(funct.get_user_group(id=1))
     cmd = "sed -i 's!%s$!!' %s/%s/%s/%s" % (ip, lib_path, lists_path, user_group, list_name)
     cmd1 = "sed -i '/^$/d' %s/%s/%s/%s" % (lib_path, lists_path, user_group, list_name)
     output, stderr = funct.subprocess_execute(cmd)
     output1, stderr1 = funct.subprocess_execute(cmd1)
     if output:
@@ -390,18 +351,13 @@ if form.getvalue('list_ip_for_add') is not None:
     lists_path = sql.get_setting('lists_path')
     lib_path = funct.get_config_var('main', 'lib_path')
     ip = form.getvalue('list_ip_for_add')
     ip = ip.strip()
     ip = funct.is_ip_or_dns(ip)
-    list_id = form.getvalue('list_id_for_add')
-    list_name = form.getvalue('list_name')
-    user_group = funct.get_user_group(id=1)
-
-    if any((funct.checkAjaxInput(lists_path), funct.checkAjaxInput(list_id), funct.checkAjaxInput(list_name))):
-        print('error: Nice try')
-        sys.exit()
-
+    list_id = funct.checkAjaxInput(form.getvalue('list_id_for_add'))
+    list_name = funct.checkAjaxInput(form.getvalue('list_name'))
+    user_group = funct.checkAjaxInput(funct.get_user_group(id=1))
     cmd = 'echo "add acl #%s %s" |nc %s %s' % (list_id, ip, serv, haproxy_sock_port)
     output, stderr = funct.subprocess_execute(cmd)
     if output[0]:
         print('error: ' + output[0])
     if stderr:
@@ -421,19 +377,11 @@ if form.getvalue('list_ip_for_add') is not None:
 if form.getvalue('sessions_select') is not None:
     from jinja2 import Environment, FileSystemLoader
 
     env = Environment(loader=FileSystemLoader('templates'), autoescape=True,
                       extensions=['jinja2.ext.loopcontrols', 'jinja2.ext.do'], trim_blocks=True, lstrip_blocks=True)
-    serv = form.getvalue('sessions_select')
-
-    if funct.checkAjaxInput(serv):
-        print('error: Nice try')
-        sys.exit()
-
-    if funct.checkAjaxInput(serv):
-        print('error: Nice try')
-        sys.exit()
+    serv = funct.checkAjaxInput(form.getvalue('sessions_select'))
 
     haproxy_sock_port = sql.get_setting('haproxy_sock_port')
 
     cmd = 'echo "show sess" |nc %s %s' % (serv, haproxy_sock_port)
     output, stderr = funct.subprocess_execute(cmd)
@@ -442,40 +390,26 @@ if form.getvalue('sessions_select') is not None:
     template = template.render(sessions=output)
 
     print(template)
 
 if form.getvalue('sessions_select_show') is not None:
-    serv = form.getvalue('sessions_select_show')
-    sess_id = form.getvalue('sessions_select_id')
-
-    if funct.checkAjaxInput(serv) or funct.checkAjaxInput(sess_id):
-        print('error: Nice try')
-        sys.exit()
-
+    serv = funct.checkAjaxInput(form.getvalue('sessions_select_show'))
+    sess_id = funct.checkAjaxInput(form.getvalue('sessions_select_id'))
     haproxy_sock_port = sql.get_setting('haproxy_sock_port')
-
     cmd = 'echo "show sess %s" |nc %s %s' % (sess_id, serv, haproxy_sock_port)
+
     output, stderr = funct.subprocess_execute(cmd)
 
     if stderr:
         print('error: ' + stderr[0])
     else:
         for o in output:
             print(o + '<br />')
 
 if form.getvalue('session_delete_id') is not None:
     haproxy_sock_port = sql.get_setting('haproxy_sock_port')
-    sess_id = form.getvalue('session_delete_id')
-
-    if funct.checkAjaxInput(sess_id):
-        print('error: Nice try')
-        sys.exit()
-
-    if funct.checkAjaxInput(sess_id):
-        print('error: Nice try')
-        sys.exit()
-
+    sess_id = funct.checkAjaxInput(form.getvalue('session_delete_id'))
     cmd = 'echo "shutdown session %s" |nc %s %s' % (sess_id, serv, haproxy_sock_port)
     output, stderr = funct.subprocess_execute(cmd)
     if output[0] != '':
         print('error: ' + output[0])
     if stderr[0] != '':
@@ -595,19 +529,11 @@ if form.getvalue('action_apache') is not None and serv is not None:
     funct.ssh_command(serv, commands)
     funct.logging(serv, 'Service has been ' + action + 'ed', haproxywi=1, login=1, keep_history=1, service='apache')
     print("success: Apache has been %s" % action)
 
 if form.getvalue('action_service') is not None:
-    action = form.getvalue('action_service')
-
-    if funct.checkAjaxInput(action):
-        print('error: Nice try')
-        sys.exit()
-
-    if funct.checkAjaxInput(action):
-        print('error: Nice try')
-        sys.exit()
+    action = funct.checkAjaxInput(form.getvalue('action_service'))
 
     if action not in ('start', 'stop', 'restart'):
         print('error: wrong action')
         sys.exit()
 
@@ -1231,16 +1157,12 @@ if serv is not None and act == "showMap":
     print('<img src="/map%s.png" alt="map">' % date)
 
 if form.getvalue('servaction') is not None:
     server_state_file = sql.get_setting('server_state_file')
     haproxy_sock = sql.get_setting('haproxy_sock')
-    enable = form.getvalue('servaction')
-    backend = form.getvalue('servbackend')
-
-    if funct.checkAjaxInput(enable) or funct.checkAjaxInput(backend):
-        print('error: Nice try')
-        sys.exit()
+    enable = funct.checkAjaxInput(form.getvalue('servaction'))
+    backend = funct.checkAjaxInput(form.getvalue('servbackend'))
 
     cmd = 'echo "{} {}" |sudo socat stdio {}'.format(enable, backend, haproxy_sock)
 
     if form.getvalue('save') == "on":
         save_command = 'echo "show servers state" | sudo socat {} stdio > {}'.format(haproxy_sock, server_state_file)
@@ -1279,16 +1201,12 @@ if act == "showCompareConfigs":
     print(template)
 
 if serv is not None and form.getvalue('right') is not None:
     from jinja2 import Environment, FileSystemLoader
 
-    left = form.getvalue('left')
-    right = form.getvalue('right')
-
-    if funct.checkAjaxInput(left) or funct.checkAjaxInput(right):
-        print('error: Nice try')
-        sys.exit()
+    left = funct.checkAjaxInput(form.getvalue('left'))
+    right = funct.checkAjaxInput(form.getvalue('right'))
 
     if form.getvalue('service') == 'nginx':
         configs_dir = funct.get_config_var('configs', 'nginx_save_configs_dir')
     elif form.getvalue('service') == 'apache':
         configs_dir = funct.get_config_var('configs', 'apache_save_configs_dir')
@@ -2552,19 +2470,11 @@ if form.getvalue('new_ssh'):
             print(output_from_parsed_template)
             funct.logging('localhost', 'A new SSH credentials ' + name + ' has created', haproxywi=1, login=1)
 
 if form.getvalue('sshdel') is not None:
     lib_path = funct.get_config_var('main', 'lib_path')
-    sshdel = form.getvalue('sshdel')
-
-    if funct.checkAjaxInput(sshdel):
-        print('error: Nice try')
-        sys.exit()
-
-    if funct.checkAjaxInput(sshdel):
-        print('error: Nice try')
-        sys.exit()
+    sshdel = funct.checkAjaxInput(form.getvalue('sshdel'))
 
     for sshs in sql.select_ssh(id=sshdel):
         ssh_enable = sshs.enable
         name = sshs.name
         ssh_key_name = lib_path + '/keys/%s.pem' % sshs.name
@@ -2610,15 +2520,11 @@ if form.getvalue('updatessh'):
 
 if form.getvalue('ssh_cert'):
     import paramiko
 
     user_group = funct.get_user_group()
-    name = form.getvalue('name')
-
-    if funct.checkAjaxInput(name):
-        print('error: Nice try')
-        sys.exit()
+    name = funct.checkAjaxInput(form.getvalue('name'))
 
     try:
         key = paramiko.pkey.load_private_key(form.getvalue('ssh_cert'))
     except Exception as e:
         print('error: Cannot save SSH key file: ', str(e))
@@ -2911,15 +2817,11 @@ if form.getvalue('updateSmonIp') is not None:
     if sql.update_smon(smon_id, ip, port, body, telegram, slack, group, desc, en):
         print("Ok")
         funct.logging('SMON', ' Has been update the server ' + ip + ' to SMON ', haproxywi=1, login=1)
 
 if form.getvalue('showBytes') is not None:
-    serv = form.getvalue('showBytes')
-
-    if funct.checkAjaxInput(serv):
-        print('error: Nice try')
-        sys.exit()
+    serv = funct.checkAjaxInput(form.getvalue('showBytes'))
 
     port = sql.get_setting('haproxy_sock_port')
     bin_bout = []
     cmd = "echo 'show stat' |nc {} {} |cut -d ',' -f 1-2,9|grep -E '[0-9]'|awk -F',' '{{sum+=$3;}}END{{print sum;}}'".format(serv, port)
     bin, stderr = funct.subprocess_execute(cmd)
@@ -2968,16 +2870,12 @@ if form.getvalue('nginxConnections'):
         print(template)
     else:
         print('error: cannot connect to Nginx stat page')
 
 if form.getvalue('waf_rule_id'):
-    enable = form.getvalue('waf_en')
-    rule_id = form.getvalue('waf_rule_id')
-
-    if funct.checkAjaxInput(enable) or funct.checkAjaxInput(rule_id):
-        print('error: Nice try')
-        sys.exit()
+    enable = funct.checkAjaxInput(form.getvalue('waf_en'))
+    rule_id = funct.checkAjaxInput(form.getvalue('waf_rule_id'))
 
     haproxy_path = sql.get_setting('haproxy_dir')
     rule_file = sql.select_waf_rule_by_id(rule_id)
     conf_file_path = haproxy_path + '/waf/modsecurity.conf'
     rule_file_path = 'Include ' + haproxy_path + '//waf/rules/' + rule_file
@@ -3049,19 +2947,11 @@ if form.getvalue('lets_domain'):
             print('success: Certificate has been created')
 
     os.system("rm -f %s" % script)
 
 if form.getvalue('uploadovpn'):
-    name = form.getvalue('ovpnname')
-
-    if funct.checkAjaxInput(name):
-        print('error: Nice try')
-        sys.exit()
-
-    if funct.checkAjaxInput(name):
-        print('error: Nice try')
-        sys.exit()
+    name = funct.checkAjaxInput(form.getvalue('ovpnname'))
 
     ovpn_file = os.path.dirname('/tmp/') + "/" + name + '.ovpn'
 
     try:
         with open(ovpn_file, "w") as conf:
@@ -3085,15 +2975,11 @@ if form.getvalue('uploadovpn'):
         funct.logging('localhost', e.args[0], haproxywi=1)
 
     funct.logging("localhost", " has been uploaded a new ovpn file %s" % ovpn_file, haproxywi=1, login=1)
 
 if form.getvalue('openvpndel') is not None:
-    openvpndel = form.getvalue('openvpndel')
-
-    if funct.checkAjaxInput(openvpndel):
-        print('error: Nice try')
-        sys.exit()
+    openvpndel = funct.checkAjaxInput(form.getvalue('openvpndel'))
 
     cmd = 'sudo openvpn3 config-remove --config /tmp/%s.ovpn --force' % openvpndel
     try:
         funct.subprocess_execute(cmd)
         print("Ok")
@@ -3101,16 +2987,12 @@ if form.getvalue('openvpndel') is not None:
     except IOError as e:
         print(e.args[0])
         funct.logging('localhost', e.args[0], haproxywi=1)
 
 if form.getvalue('actionvpn') is not None:
-    openvpn = form.getvalue('openvpnprofile')
-    action = form.getvalue('actionvpn')
-
-    if funct.checkAjaxInput(openvpn) or funct.checkAjaxInput(action):
-        print('error: Nice try')
-        sys.exit()
+    openvpn = funct.checkAjaxInput(form.getvalue('openvpnprofile'))
+    action = funct.checkAjaxInput(form.getvalue('actionvpn'))
 
     if action == 'start':
         cmd = 'sudo openvpn3 session-start --config /tmp/%s.ovpn' % openvpn
     elif action == 'restart':
         cmd = 'sudo openvpn3 session-manage --config /tmp/%s.ovpn --restart' % openvpn
@@ -3123,16 +3005,11 @@ if form.getvalue('actionvpn') is not None:
     except IOError as e:
         print(e.args[0])
         funct.logging('localhost', e.args[0], haproxywi=1)
 
 if form.getvalue('scan_ports') is not None:
-    serv_id = form.getvalue('scan_ports')
-
-    if funct.checkAjaxInput(serv_id):
-        print('error: Nice try')
-        sys.exit()
-
+    serv_id = funct.checkAjaxInput(form.getvalue('scan_ports'))
     server = sql.select_servers(id=serv_id)
     ip = ''
 
     for s in server:
         ip = s[2]
@@ -3152,15 +3029,11 @@ if form.getvalue('scan_ports') is not None:
         template = env.get_template('ajax/scan_ports.html')
         template = template.render(ports=stdout, info=stdout1)
         print(template)
 
 if form.getvalue('viewFirewallRules') is not None:
-    serv = form.getvalue('viewFirewallRules')
-
-    if funct.checkAjaxInput(serv):
-        print('error: Nice try')
-        sys.exit()
+    serv = funct.checkAjaxInput(form.getvalue('viewFirewallRules'))
 
     cmd = ["sudo iptables -L INPUT -n --line-numbers|sed 's/  */ /g'|grep -v -E 'Chain|target'"]
     cmd1 = ["sudo iptables -L IN_public_allow -n --line-numbers|sed 's/  */ /g'|grep -v -E 'Chain|target'"]
     cmd2 = ["sudo iptables -L OUTPUT -n --line-numbers|sed 's/  */ /g'|grep -v -E 'Chain|target'"]
 
@@ -3184,15 +3057,10 @@ if form.getvalue('viewFirewallRules') is not None:
     template = template.render(input=input_chain2, IN_public_allow=IN_public_allow, output=output_chain)
     print(template)
 
 if form.getvalue('geoipserv') is not None:
     serv = form.getvalue('geoipserv')
-
-    if funct.checkAjaxInput(serv):
-        print('error: Nice try')
-        sys.exit()
-
     haproxy_dir = sql.get_setting('haproxy_dir')
 
     cmd = ["ls " + haproxy_dir + "/geoip/"]
     print(funct.ssh_command(serv, cmd))
 
@@ -4529,16 +4397,12 @@ if act == 'check_service':
     import http.cookies
     cookie = http.cookies.SimpleCookie(os.environ.get("HTTP_COOKIE"))
     user_uuid = cookie.get('uuid')
     user_id = sql.get_user_id_by_uuid(user_uuid.value)
     user_services = sql.select_user_services(user_id)
-    server_id = form.getvalue('server_id')
-    service = form.getvalue('service')
-
-    if funct.checkAjaxInput(server_id) or funct.checkAjaxInput(service):
-        print('error: Nice try')
-        sys.exit()
+    server_id = funct.checkAjaxInput(form.getvalue('server_id'))
+    service = funct.checkAjaxInput(form.getvalue('service'))
 
     if '1' in user_services:
         if service == 'haproxy':
             haproxy_sock_port = sql.get_setting('haproxy_sock_port')
             cmd = 'echo "show info" |nc %s %s -w 1 -v|grep Name' % (serv, haproxy_sock_port)

Vulnerable code:     cert_id = form.getvalue('getcert')
    if funct.checkAjaxInput(cert_id):
        print('error: Nice try')
        sys.exit()
    if funct.checkAjaxInput(cert_id):
        print('error: Nice try')
        sys.exit()

        name = form.getvalue('ssl_name')
        if funct.checkAjaxInput(name):
            print('error: Nice try')
            sys.exit()
    backend = form.getvalue('ipbackend')
    if funct.checkAjaxInput(backend):
        print('error: Nice try')
        sys.exit()
    backend = form.getvalue('ipbackend')
    backend_server = form.getvalue('backend_server')
    if funct.checkAjaxInput(backend) or funct.checkAjaxInput(backend_server):
        print('error: Nice try')
        sys.exit()
    backend_backend = form.getvalue('backend_backend')
    backend_server = form.getvalue('backend_server')
    backend_ip = form.getvalue('backend_ip')
    backend_port = form.getvalue('backend_port')
    if any((funct.checkAjaxInput(backend_backend), funct.checkAjaxInput(backend_server), funct.checkAjaxInput(backend_ip), funct.checkAjaxInput(backend_port))):
        print('error: Nice try')
        sys.exit()
    serv = form.getvalue('maxconn_select')
    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()
    frontend = form.getvalue('maxconn_frontend')
    maxconn = form.getvalue('maxconn_int')
    if funct.checkAjaxInput(frontend) or funct.checkAjaxInput(maxconn):
        print('error: Nice try')
        sys.exit()
    ip = form.getvalue('ip_for_delete')
    table = form.getvalue('table_for_delete')

    if funct.checkAjaxInput(ip) or funct.checkAjaxInput(table):
        print('error: Nice try')
        sys.exit()
    table = form.getvalue('table_for_clear')

    if funct.checkAjaxInput(table):
        print('error: Nice try')
        sys.exit()
    list_id = form.getvalue('list_select_id')
    list_name = form.getvalue('list_select_name')

    if funct.checkAjaxInput(list_id) or funct.checkAjaxInput(list_name):
        print('error: Nice try')
        sys.exit()
    lib_path = funct.get_config_var('main', 'lib_path')
    ip_id = form.getvalue('list_ip_id_for_delete')
    ip = form.getvalue('list_ip_for_delete')
    list_id = form.getvalue('list_id_for_delete')
    list_name = form.getvalue('list_name')
    user_group = funct.get_user_group(id=1)

    if any((funct.checkAjaxInput(ip_id), funct.checkAjaxInput(ip), funct.checkAjaxInput(list_id), funct.checkAjaxInput(list_name))):
        print('error: Nice try')
        sys.exit()

    list_id = form.getvalue('list_id_for_add')
    list_name = form.getvalue('list_name')
    user_group = funct.get_user_group(id=1)

    if any((funct.checkAjaxInput(lists_path), funct.checkAjaxInput(list_id), funct.checkAjaxInput(list_name))):
        print('error: Nice try')
        sys.exit()

    serv = form.getvalue('sessions_select')

    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()
    serv = form.getvalue('sessions_select_show')
    sess_id = form.getvalue('sessions_select_id')

    if funct.checkAjaxInput(serv) or funct.checkAjaxInput(sess_id):
        print('error: Nice try')
        sys.exit()


    sess_id = form.getvalue('session_delete_id')

    if funct.checkAjaxInput(sess_id):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(sess_id):
        print('error: Nice try')
        sys.exit()

    action = form.getvalue('action_service')

    if funct.checkAjaxInput(action):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(action):
        print('error: Nice try')
        sys.exit()
    enable = form.getvalue('servaction')
    backend = form.getvalue('servbackend')

    if funct.checkAjaxInput(enable) or funct.checkAjaxInput(backend):
        print('error: Nice try')
        sys.exit()
    left = form.getvalue('left')
    right = form.getvalue('right')

    if funct.checkAjaxInput(left) or funct.checkAjaxInput(right):
        print('error: Nice try')
        sys.exit()
    sshdel = form.getvalue('sshdel')

    if funct.checkAjaxInput(sshdel):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(sshdel):
        print('error: Nice try')
        sys.exit()
    name = form.getvalue('name')

    if funct.checkAjaxInput(name):
        print('error: Nice try')
        sys.exit()
    serv = form.getvalue('showBytes')

    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()
    enable = form.getvalue('waf_en')
    rule_id = form.getvalue('waf_rule_id')

    if funct.checkAjaxInput(enable) or funct.checkAjaxInput(rule_id):
        print('error: Nice try')
        sys.exit()
    name = form.getvalue('ovpnname')

    if funct.checkAjaxInput(name):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(name):
        print('error: Nice try')
        sys.exit()
    openvpndel = form.getvalue('openvpndel')

    if funct.checkAjaxInput(openvpndel):
        print('error: Nice try')
        sys.exit()
    openvpn = form.getvalue('openvpnprofile')
    action = form.getvalue('actionvpn')

    if funct.checkAjaxInput(openvpn) or funct.checkAjaxInput(action):
        print('error: Nice try')
        sys.exit()
    serv_id = form.getvalue('scan_ports')

    if funct.checkAjaxInput(serv_id):
        print('error: Nice try')
        sys.exit()

    serv = form.getvalue('viewFirewallRules')

    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()

    if funct.checkAjaxInput(serv):
        print('error: Nice try')
        sys.exit()

    server_id = form.getvalue('server_id')
    service = form.getvalue('service')

    if funct.checkAjaxInput(server_id) or funct.checkAjaxInput(service):
        print('error: Nice try')
        sys.exit()
Fixed code:     cert_id = funct.checkAjaxInput(form.getvalue('getcert'))
    cert_id = form.getvalue('delcert')
    cert_id = funct.checkAjaxInput(cert_id)
        name = funct.checkAjaxInput(form.getvalue('ssl_name'))
    backend = funct.checkAjaxInput(form.getvalue('ipbackend'))
    backend = funct.checkAjaxInput(form.getvalue('ipbackend'))
    backend_server = funct.checkAjaxInput(form.getvalue('backend_server'))
    backend_backend = funct.checkAjaxInput(form.getvalue('backend_backend'))
    backend_server = funct.checkAjaxInput(form.getvalue('backend_server'))
    backend_ip = funct.checkAjaxInput(form.getvalue('backend_ip'))
    backend_port = funct.checkAjaxInput(form.getvalue('backend_port'))

    serv = funct.checkAjaxInput(form.getvalue('maxconn_select'))
    frontend = funct.checkAjaxInput(form.getvalue('maxconn_frontend'))
    maxconn = funct.checkAjaxInput(form.getvalue('maxconn_int'))
    ip = funct.checkAjaxInput(form.getvalue('ip_for_delete'))
    table = funct.checkAjaxInput(form.getvalue('table_for_delete'))
    table = funct.checkAjaxInput(form.getvalue('table_for_clear'))
    list_id = funct.checkAjaxInput(form.getvalue('list_select_id'))
    list_name = funct.checkAjaxInput(form.getvalue('list_select_name'))
    lib_path = funct.checkAjaxInput(funct.get_config_var('main', 'lib_path'))
    ip_id = funct.checkAjaxInput(form.getvalue('list_ip_id_for_delete'))
    ip = funct.checkAjaxInput(form.getvalue('list_ip_for_delete'))
    list_id = funct.checkAjaxInput(form.getvalue('list_id_for_delete'))
    list_name = funct.checkAjaxInput(form.getvalue('list_name'))
    user_group = funct.checkAjaxInput(funct.get_user_group(id=1))
    list_id = funct.checkAjaxInput(form.getvalue('list_id_for_add'))
    list_name = funct.checkAjaxInput(form.getvalue('list_name'))
    user_group = funct.checkAjaxInput(funct.get_user_group(id=1))
    serv = funct.checkAjaxInput(form.getvalue('sessions_select'))
    serv = funct.checkAjaxInput(form.getvalue('sessions_select_show'))
    sess_id = funct.checkAjaxInput(form.getvalue('sessions_select_id'))

    sess_id = funct.checkAjaxInput(form.getvalue('session_delete_id'))
    action = funct.checkAjaxInput(form.getvalue('action_service'))
    enable = funct.checkAjaxInput(form.getvalue('servaction'))
    backend = funct.checkAjaxInput(form.getvalue('servbackend'))
    left = funct.checkAjaxInput(form.getvalue('left'))
    right = funct.checkAjaxInput(form.getvalue('right'))
    sshdel = funct.checkAjaxInput(form.getvalue('sshdel'))
    name = funct.checkAjaxInput(form.getvalue('name'))
    serv = funct.checkAjaxInput(form.getvalue('showBytes'))
    enable = funct.checkAjaxInput(form.getvalue('waf_en'))
    rule_id = funct.checkAjaxInput(form.getvalue('waf_rule_id'))
    name = funct.checkAjaxInput(form.getvalue('ovpnname'))
    openvpndel = funct.checkAjaxInput(form.getvalue('openvpndel'))
    openvpn = funct.checkAjaxInput(form.getvalue('openvpnprofile'))
    action = funct.checkAjaxInput(form.getvalue('actionvpn'))
    serv_id = funct.checkAjaxInput(form.getvalue('scan_ports'))
    serv = funct.checkAjaxInput(form.getvalue('viewFirewallRules'))
    server_id = funct.checkAjaxInput(form.getvalue('server_id'))
    service = funct.checkAjaxInput(form.getvalue('service'))