CVE-2015-10045: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability, which was classified as critical, was found in tutrantta project_todolist. Affected is the function getAffectedRows/where/insert/update in the library library/Database.php. The manipulation leads to sql injection. The name of the patch is 194a0411bbe11aa4813f13c66b9e8ea403539141. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218352.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-15T10:15Z
Repository: https://github.com/tutrantta/project_todolist
Language: PHP
Files changed: library/Database.php
Commit date: 2015-01-13 23:23:09 +0700
Commit message: add SQL injection preventor

Diff: diff --git a/library/Database.php b/library/Database.php
index 838600c..c26efa8 100644
--- a/library/Database.php
+++ b/library/Database.php
@@ -20,10 +20,14 @@ class Database
 	function getAffectedRows()
 	{
 		return mysqli_affected_rows($this->connection);
 	}
 
+	function sqlInjectionPrevent($value) {
+		return mysqli_real_escape_string($this->connection, $value);
+	}
+
 	function query($sql) {
 		$queryData = $this->connection->query($sql);
 		if(!$this->getAffectedRows()) return false;
 		if($queryData === true || $queryData === false) return $queryData;
 		$result = array();
@@ -38,11 +42,11 @@ class Database
 	function where($where = array()) 
 	{
 		if(count($where)) {
 			$arrTempWhere = array();
 			foreach($where as $key => $value) {
-				if(is_string($value)) $arrTempWhere[] = '' . $key . " = '" . $value . "'";
+				if(is_string($value)) $arrTempWhere[] = '' . $key . " = '" . $this->sqlInjectionPrevent($value) . "'";
 				else $arrTempWhere[] = '' . $key . " = " . $value;
 			}
 			$strWhere = implode(' AND ', $arrTempWhere);
 			return ' WHERE ' . $strWhere;
 		}
@@ -53,21 +57,22 @@ class Database
 	{
 		$sql = 'SELECT ';
 		if($columns === array()) $sql .= '*';
 		else $sql .= implode(',', $columns);
 		$sql .= ' FROM ' . $table . ' ' . $this->where($where);
+		var_dump($sql);
 		return $this->query($sql);
 	}
 
 	function insert($values = array(), $table = '') 
 	{
 		$sql = "INSERT INTO $table (";
 		$arrKeys = array();
 		$arrValues = array();
 		foreach($values as $key => $value) {
 			$arrKeys[] = $key;
-			if(is_string($value)) $arrValues[] = " '$value' ";
+			if(is_string($value)) $arrValues[] = " '" . $this->sqlInjectionPrevent($value) . "' ";
 			else $arrValues[]  = "$value";
 		}
 		$sql .= implode(',', $arrKeys) . ') VALUES (' . implode(',', $arrValues) . ')';
 		return $this->query($sql);
 	}
@@ -81,11 +86,11 @@ class Database
 
 	function update($values = array(), $table = '', $where = array())
 	{
 		$arrTempValue = array();
 		foreach($values as $key => $value) {
-			if(is_string($value)) $arrTempValue[] = "$key = '$value' ";
+			if(is_string($value)) $arrTempValue[] = "$key = '" . $this->sqlInjectionPrevent($value) . "' ";
 			else $arrTempValue[]  = "$key = $value";
 		}
 		$strValue = implode(',', $arrTempValue);
 		$sql = "UPDATE $table SET $strValue " . $this->where($where);
 		return $this->query($sql);

Vulnerable code: 				if(is_string($value)) $arrTempWhere[] = '' . $key . " = '" . $value . "'";
			if(is_string($value)) $arrValues[] = " '$value' ";
			if(is_string($value)) $arrTempValue[] = "$key = '$value' ";
Fixed code: 	function sqlInjectionPrevent($value) {
		return mysqli_real_escape_string($this->connection, $value);
	}

				if(is_string($value)) $arrTempWhere[] = '' . $key . " = '" . $this->sqlInjectionPrevent($value) . "'";
		var_dump($sql);
			if(is_string($value)) $arrValues[] = " '" . $this->sqlInjectionPrevent($value) . "' ";
			if(is_string($value)) $arrTempValue[] = "$key = '" . $this->sqlInjectionPrevent($value) . "' ";