CVE-2014-1401: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2014-02-11T17:55Z
Repository: https://github.com/auracms/AuraCMS
Language: PHP
Files changed: mod/statistik/vcounter.php
Commit date: 2014-01-31 10:54:24 +0700
Commit message: Update VCounter

Update VCounter

Diff: diff --git a/mod/statistik/vcounter.php b/mod/statistik/vcounter.php
index 5d255c1..6ff8232 100644
--- a/mod/statistik/vcounter.php
+++ b/mod/statistik/vcounter.php
@@ -25,33 +25,33 @@
 		}
 		
 		function ipCheck() {
 
 			if (getenv('HTTP_CLIENT_IP')) {
-				$ip = getenv('HTTP_CLIENT_IP');
+				$ip = mysql_real_escape_string(getenv('HTTP_CLIENT_IP'));
 			}
 			elseif (getenv('HTTP_X_FORWARDED_FOR')) {
-				$ip = getenv('HTTP_X_FORWARDED_FOR');
+				$ip = mysql_real_escape_string(getenv('HTTP_X_FORWARDED_FOR'));
 			}
 			elseif (getenv('HTTP_X_FORWARDED')) {
-				$ip = getenv('HTTP_X_FORWARDED');
+				$ip = mysql_real_escape_string(getenv('HTTP_X_FORWARDED'));
 			}
 			elseif (getenv('HTTP_FORWARDED_FOR')) {
-				$ip = getenv('HTTP_FORWARDED_FOR');
+				$ip = mysql_real_escape_string(getenv('HTTP_FORWARDED_FOR'));
 			}
 			elseif (getenv('HTTP_FORWARDED')) {
-				$ip = getenv('HTTP_FORWARDED');
+				$ip = mysql_real_escape_string(getenv('HTTP_FORWARDED'));
 			}
 			else {
-				$ip = $_SERVER['REMOTE_ADDR'];
+				$ip = mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
 			}
 			return $ip;
 		}
 		
 		function new_user() {
 			global $db;
-			$insert = $db->sql_query("INSERT INTO `mod_useronline` (`timestamp`, `ip`) VALUES ('mysql_real_escape_string($this->timestamp)', 'mysql_real_escape_string($this->ip)')");
+			$insert = $db->sql_query("INSERT INTO `mod_useronline` (`timestamp`, `ip`) VALUES ('$this->timestamp', '$this->ip')");
 			if (!$insert) {
 				$this->error[$this->i] = "Unable to record new visitor\r\n";			
 				$this->i ++;
 			}
 		}
@@ -118,11 +118,11 @@
 	$weekday		 =	$weekday * 24*60*60;
 	$weekstart		 =	$daystart - $weekday;
 
 	$yesterdaystart	 =	$daystart - (24*60*60);
 	$now			 =	time();
-	$ip				 =	getIP();
+	$ip				 =	mysql_real_escape_string(getIP());
 	
 
 	$r	= mysql_query("SELECT MAX( id ) AS total FROM `mod_visitcounter`");
 	list($total) = mysql_fetch_array($r);
 
@@ -138,16 +138,16 @@
 	
 	if ($temp>0){
 		//$query		 =  mysql_query ("DELETE FROM `mod_visitcounter` WHERE `id`<'$temp'");
 	}
 	
-	$item	=	mysql_fetch_assoc(mysql_query ("SELECT COUNT(*) AS `total` FROM `mod_visitcounter` WHERE `ip`='mysql_real_escape_string($ip)' AND (tm+'$locktime')>'$now'"));
+	$item	=	mysql_fetch_assoc(mysql_query ("SELECT COUNT(*) AS `total` FROM `mod_visitcounter` WHERE `ip`='$ip' AND (tm+'$locktime')>'$now'"));
 	$items	=	$item['total'];
 	
 	if (empty($items))
 	{
-		mysql_query ("INSERT INTO `mod_visitcounter` (`id`, `tm`, `ip`) VALUES ('', '$now', 'mysql_real_escape_string($ip)')");
+		mysql_query ("INSERT INTO `mod_visitcounter` (`id`, `tm`, `ip`) VALUES ('', '$now', '$ip')");
 	}
 	
 	$n				 = 	$all_visitors;
 	$div = 100000;
 	while ($n > $div) {

Vulnerable code: 				$ip = getenv('HTTP_CLIENT_IP');
				$ip = getenv('HTTP_X_FORWARDED_FOR');
				$ip = getenv('HTTP_X_FORWARDED');
				$ip = getenv('HTTP_FORWARDED_FOR');
				$ip = getenv('HTTP_FORWARDED');
				$ip = $_SERVER['REMOTE_ADDR'];
			$insert = $db->sql_query("INSERT INTO `mod_useronline` (`timestamp`, `ip`) VALUES ('mysql_real_escape_string($this->timestamp)', 'mysql_real_escape_string($this->ip)')");
	$ip				 =	getIP();
	$item	=	mysql_fetch_assoc(mysql_query ("SELECT COUNT(*) AS `total` FROM `mod_visitcounter` WHERE `ip`='mysql_real_escape_string($ip)' AND (tm+'$locktime')>'$now'"));
		mysql_query ("INSERT INTO `mod_visitcounter` (`id`, `tm`, `ip`) VALUES ('', '$now', 'mysql_real_escape_string($ip)')");
Fixed code: 				$ip = mysql_real_escape_string(getenv('HTTP_CLIENT_IP'));
				$ip = mysql_real_escape_string(getenv('HTTP_X_FORWARDED_FOR'));
				$ip = mysql_real_escape_string(getenv('HTTP_X_FORWARDED'));
				$ip = mysql_real_escape_string(getenv('HTTP_FORWARDED_FOR'));
				$ip = mysql_real_escape_string(getenv('HTTP_FORWARDED'));
				$ip = mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
			$insert = $db->sql_query("INSERT INTO `mod_useronline` (`timestamp`, `ip`) VALUES ('$this->timestamp', '$this->ip')");
	$ip				 =	mysql_real_escape_string(getIP());
	$item	=	mysql_fetch_assoc(mysql_query ("SELECT COUNT(*) AS `total` FROM `mod_visitcounter` WHERE `ip`='$ip' AND (tm+'$locktime')>'$now'"));
		mysql_query ("INSERT INTO `mod_visitcounter` (`id`, `tm`, `ip`) VALUES ('', '$now', '$ip')");