CVE-2014-125085: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability, which was classified as critical, was found in Gimmie Plugin 1.2.2 on vBulletin. Affected is an unknown function of the file trigger_ratethread.php. The manipulation of the argument t/postusername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The patch is identified as f11a136e9cbd24997354965178728dc22a2aa2ed. It is recommended to upgrade the affected component. VDB-220206 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-02-06T00:15Z
Repository: https://github.com/gimmie/vbulletin-v4
Language: PHP
Files changed: Upload/plugins/gimmie/trigger_ratethread.php
Commit date: 2014-09-08 17:13:35 +0800
Commit message: Update trigger_ratethread.php to prevent SQL Injection
Diff: diff --git a/Upload/plugins/gimmie/trigger_ratethread.php b/Upload/plugins/gimmie/trigger_ratethread.php
index 3404e8c..1676bbd 100644
--- a/Upload/plugins/gimmie/trigger_ratethread.php
+++ b/Upload/plugins/gimmie/trigger_ratethread.php
@@ -34,14 +34,14 @@ if (in_array($threadinfo[forumid], $forumarray) || $vbulletin->options['gimmie_t
   }
 
   if ($vbulletin->options['gimmie_enable_global'] == 1 && $vbulletin->options['gimmie_trigger_perthreadratingreceived'] == 1)
   {
 
-    $threadsql  = $vbulletin->db->query_read("SELECT * FROM " . TABLE_PREFIX . "thread WHERE `threadid` = '" . $_POST['t'] . "'");
+    $threadsql  = $vbulletin->db->query_read("SELECT * FROM " . TABLE_PREFIX . "thread WHERE `threadid` = " . $vbulletin->db->escape_string($_POST['t']));
     $thread   = $vbulletin->db->fetch_array($threadsql);
 
-    $usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `username` = '" . $thread['postusername'] . "'");
+    $usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `username` = " . $vbulletin->db->escape_string($thread['postusername']));
     
     $user   = $vbulletin->db->fetch_array($usersql);
 
     $access_token         = $user['email'];
     $access_token_secret    = $secret;
@@ -59,6 +59,6 @@ if (in_array($threadinfo[forumid], $forumarray) || $vbulletin->options['gimmie_t
     return;
   
   }
 }
 
-?>
\ No newline at end of file
+?>

Vulnerable code:     $threadsql  = $vbulletin->db->query_read("SELECT * FROM " . TABLE_PREFIX . "thread WHERE `threadid` = '" . $_POST['t'] . "'");
    $usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `username` = '" . $thread['postusername'] . "'");
?>
Fixed code:     $threadsql  = $vbulletin->db->query_read("SELECT * FROM " . TABLE_PREFIX . "thread WHERE `threadid` = " . $vbulletin->db->escape_string($_POST['t']));
    $usersql  = $vbulletin->db->query_read("SELECT `userid`, `username`, `email` FROM " . TABLE_PREFIX . "user WHERE `username` = " . $vbulletin->db->escape_string($thread['postusername']));
?>