CVE-2015-1428: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2015-02-03T16:59Z
Repository: https://github.com/sefrengo-cms/sefrengo-1.x
Language: SQL
Files changed: changelog.md, setup/index.php, setup/sql/config.sql, setup/sql/updates_from.01.06.01.sql
Commit date: 2015-01-25 19:36:29 +0100
Commit message: Updated version number to v1.6.2

Diff: diff --git a/changelog.md b/changelog.md
index 39ed4a7..82ed178 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,8 +1,20 @@
 Changelog
 ================================================================================================
 
+Sefrengo v1.6.2
+------------------------------------------------------------------------------------------------
+Internal versionnumber: 01.06.02<br/>
+Release: 25.01.2015
+
+See full changelog at <https://github.com/sefrengo-cms/sefrengo-1.x/commits/v1.6.2>
+
+* FIXED: Escaped strings for session ids and name
+* ADDED: Sortable CSS and JS files for layouts (thanks to sidd)
+
+
+
 Sefrengo v1.6.1
 ------------------------------------------------------------------------------------------------
 Internal versionnumber: 01.06.01<br/>
 Release: 04.01.2015
 
diff --git a/setup/index.php b/setup/index.php
index 393ca60..e2cedbc 100644
--- a/setup/index.php
+++ b/setup/index.php
@@ -127,21 +127,22 @@ class setup {
 							'updates_from.01.04.04.sql',
 							'updates_from.01.04.05.sql',
 							'updates_from.01.04.06.sql',
 							'updates_from.01.05.00.sql',
 							'updates_from.01.05.01.sql',
-							'updates_from.01.06.00.sql');
+							'updates_from.01.06.00.sql',
+							'updates_from.01.06.01.sql');
 
 	/**
 	* Konstruktor. Catch all globals
 	*/
 	function setup()
 	{
 		$this -> catch_globals();
 		$this -> version['prior'] = '01';
 		$this -> version['minor'] = '06';
-		$this -> version['fix']   = '01';
+		$this -> version['fix']   = '02';
 		$this -> version_text = $this -> version['prior'];
 		$this -> version_text .= '.';
 		$this -> version_text .= $this -> version['minor'];
 		$this -> version_text .= '.';
 		$this -> version_text .= $this -> version['fix'];
diff --git a/setup/sql/config.sql b/setup/sql/config.sql
index 69c7ae1..99c8e1d 100644
--- a/setup/sql/config.sql
+++ b/setup/sql/config.sql
@@ -319,11 +319,11 @@ INSERT INTO cms_values VALUES ('', 0, 0, 'css_units', 'borderstyle', 'v', '', ''
 INSERT INTO cms_values VALUES ('', 0, 0, 'css_units', 'bgrepeat', 'v', '', '', '(repeat(\\-(x|y))?)|no\\-repeat', 0, NULL, NULL, 'txt', NULL, NULL, 0);
 INSERT INTO cms_values VALUES ('', 0, 0, 'css_units', 'auto', 'v', '', '', 'auto', 0, NULL, NULL, 'txt', NULL, NULL, 0);
 INSERT INTO cms_values VALUES ('', 0, 0, 'css_units', 'attachment', 'v', '', '', 'fixed|scroll', 0, NULL, NULL, 'txt', NULL, NULL, 0);
 
 # cms config
-INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'version', '', '', '', '01.06.01', '0', NULL, NULL, '', NULL, NULL, '0');
+INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'version', '', '', '', '01.06.02', '0', NULL, NULL, '', NULL, NULL, '0');
 
 INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'cms_path', NULL, NULL, NULL, '<!--{cms_path}-->backend/', 100, 'set_cms_path', NULL, 'txt', NULL, NULL, '1');
 INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'cms_html_path', NULL, NULL, NULL, '<!--{cms_full_http_path}-->backend/', 101, 'set_html_path', NULL, 'txt', NULL, NULL, '1');
 INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'backend_lang', '', '', '', 'de', 102, 'set_backend_lang', NULL, 'txt', NULL, NULL, '1');
 INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'skin', '', '', '', 'standard', 103, 'set_skin', NULL, 'txt', NULL, NULL, '1');
diff --git a/setup/sql/updates_from.01.06.01.sql b/setup/sql/updates_from.01.06.01.sql
new file mode 100644
index 0000000..ece6d15
--- /dev/null
+++ b/setup/sql/updates_from.01.06.01.sql
@@ -0,0 +1,2 @@
+# 25.01.2015 set new versionnumber - Sefrengo 1.6.2
+UPDATE cms_values  SET value =  '01.06.02' WHERE group_name =  'cfg' AND key1 =  'version';

Vulnerable code: 							'updates_from.01.06.00.sql');
		$this -> version['fix']   = '01';
INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'version', '', '', '', '01.06.01', '0', NULL, NULL, '', NULL, NULL, '0');
Fixed code: Sefrengo v1.6.2
------------------------------------------------------------------------------------------------
Internal versionnumber: 01.06.02<br/>
Release: 25.01.2015

See full changelog at <https://github.com/sefrengo-cms/sefrengo-1.x/commits/v1.6.2>

* FIXED: Escaped strings for session ids and name
* ADDED: Sortable CSS and JS files for layouts (thanks to sidd)



							'updates_from.01.06.00.sql',
							'updates_from.01.06.01.sql');
		$this -> version['fix']   = '02';
INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'version', '', '', '', '01.06.02', '0', NULL, NULL, '', NULL, NULL, '0');
# 25.01.2015 set new versionnumber - Sefrengo 1.6.2
UPDATE cms_values  SET value =  '01.06.02' WHERE group_name =  'cfg' AND key1 =  'version';