CVE-2022-43279: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.2
Published: 2022-11-15T21:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/controllers/admin/SurveysGroupsController.php, application/views/admin/surveysgroups/update.php
Commit date: 2021-06-10 16:03:56 +0200
Commit message: Fixed issue: Page Header and TopBar: Surveys - Survey Groups - Edit Survey Group
- Added TypeHints.
- Added green bar
- Added top bar
- Added shadow under top bar
- Renamed 'Close' to 'Back' Button

Diff: diff --git a/application/controllers/admin/SurveysGroupsController.php b/application/controllers/admin/SurveysGroupsController.php
index f5058ba334c..4c03fdafff5 100644
--- a/application/controllers/admin/SurveysGroupsController.php
+++ b/application/controllers/admin/SurveysGroupsController.php
@@ -103,12 +103,13 @@ class SurveysGroupsController extends Survey_Common_Action
      * Show and updates a particular model.
      * If update is successful, the browser will be redirected to the 'view' page.
      *
      * @param integer $id the ID of the model to be updated
      * @return void
+     * @throws CHttpException
      */
-    public function update($id)
+    public function update(int $id)
     {
         $model = $this->loadModel($id);
         if (!empty(App()->getRequest()->getPost('SurveysGroups'))) {
             if (!$model->hasPermission('group', 'update')) {
                 throw new CHttpException(403, gT("You do not have permission to access this page."));
@@ -149,23 +150,41 @@ class SurveysGroupsController extends Survey_Common_Action
                     $this->getController()->redirect($this->getController()->createUrl('surveyAdministration/listsurveys', array("#" => 'surveygroups')));
                 }
             }
         }
 
+        $oSurveySearch = new Survey('search');
+        $oSurveySearch->gsid = $model->gsid;
+
         $aData = array(
             'model' => $model,
             'action' => App()->createUrl("admin/surveysgroups/sa/update", array('id' => $model->gsid, '#' => 'settingsForThisGroup')),
+            'pageTitle' => 'Update survey group: ' . $model->title,
         );
-        $oSurveySearch = new Survey('search');
-        $oSurveySearch->gsid = $model->gsid;
+
         $aData['oSurveySearch'] = $oSurveySearch;
         $aData['aRigths'] = array(
             'update' => $model->hasPermission('group', 'update'),
             'delete' => $model->hasPermission('group', 'delete'),
             'owner_id' => $model->owner_id == Yii::app()->user->id || Permission::model()->hasGlobalPermission('superadmin', 'read')
         );
 
+        $updateRightsForm = $aData['aRigths']['update'] ? 'surveys-groups-form' : null;
+
+        $aData['fullpagebar'] = [
+            'returnbutton' => [
+                'url' => 'surveyAdministration/listsurveys#surveygroups',
+                'text' => gT('Back'),
+            ],
+            'savebutton' => [
+                'form' => $updateRightsForm,
+            ],
+            'saveandclosebutton' => [
+                '$updateRightsForm',
+            ],
+        ];
+
         /* User for dropdown */
         $aUserIds = getUserList('onlyuidarray');
         if (!in_array($model->owner_id, $aUserIds)) {
             $aUserIds[] = $model->owner_id;
         }
@@ -176,10 +195,11 @@ class SurveysGroupsController extends Survey_Common_Action
         $aData['oUsers'] = User::model()->findAll($userCriteria);
 
         $oTemplateOptions           = new TemplateConfiguration();
         $oTemplateOptions->scenario = 'surveygroup';
         $aData['templateOptionsModel'] = $oTemplateOptions;
+
         // Page size
         if (Yii::app()->request->getParam('pageSize')) {
             Yii::app()->user->setState('pageSizeTemplateView', (int) Yii::app()->request->getParam('pageSize'));
         }
         $aData['pageSize'] = Yii::app()->user->getState('pageSizeTemplateView', Yii::app()->params['defaultPageSize']); // Page size
diff --git a/application/views/admin/surveysgroups/update.php b/application/views/admin/surveysgroups/update.php
index a4ba52ba6b7..a397a695a85 100644
--- a/application/views/admin/surveysgroups/update.php
+++ b/application/views/admin/surveysgroups/update.php
@@ -3,26 +3,10 @@
 /* @var $model SurveysGroups */
 ?>
 
 <div class="col-lg-12 list-surveys">
 
-    <h3><?php eT('Update survey group: '); echo '<strong><em>'.CHtml::encode($model->title).'</strong></em>'; ?></h3>
-    <?php $this->renderPartial('super/fullpagebar_view', array(
-            'fullpagebar' => array(
-                'returnbutton'=>array(
-                    'url'=>'surveyAdministration/listsurveys#surveygroups',
-                    'text'=>gT('Close'),
-                ),
-                'savebutton' => array(
-                    'form' => $aRigths['update'] ? 'surveys-groups-form' : null,
-                ),
-                'saveandclosebutton' => array(
-                    'form' => $aRigths['update'] ? 'surveys-groups-form' : null,
-                )
-            )
-        )); ?>
-
     <div class="row">
         <ul class="nav nav-tabs" id="surveygrouptabsystem" role="tablist">
             <li class="active"><a href="#surveysInThisGroup"><?php eT('Surveys in this group'); ?></a></li>
             <?php if($model->hasPermission('group','read')):?>
                 <li><a href="#settingsForThisGroup"><?php eT('Settings for this survey group'); ?></a></li>

Vulnerable code:     public function update($id)
        $oSurveySearch = new Survey('search');
        $oSurveySearch->gsid = $model->gsid;
    <h3><?php eT('Update survey group: '); echo '<strong><em>'.CHtml::encode($model->title).'</strong></em>'; ?></h3>
    <?php $this->renderPartial('super/fullpagebar_view', array(
            'fullpagebar' => array(
                'returnbutton'=>array(
                    'url'=>'surveyAdministration/listsurveys#surveygroups',
                    'text'=>gT('Close'),
                ),
                'savebutton' => array(
                    'form' => $aRigths['update'] ? 'surveys-groups-form' : null,
                ),
                'saveandclosebutton' => array(
                    'form' => $aRigths['update'] ? 'surveys-groups-form' : null,
                )
            )
        )); ?>

Fixed code:      * @throws CHttpException
    public function update(int $id)
        $oSurveySearch = new Survey('search');
        $oSurveySearch->gsid = $model->gsid;

            'pageTitle' => 'Update survey group: ' . $model->title,

        $updateRightsForm = $aData['aRigths']['update'] ? 'surveys-groups-form' : null;

        $aData['fullpagebar'] = [
            'returnbutton' => [
                'url' => 'surveyAdministration/listsurveys#surveygroups',
                'text' => gT('Back'),
            ],
            'savebutton' => [
                'form' => $updateRightsForm,
            ],
            'saveandclosebutton' => [
                '$updateRightsForm',
            ],
        ];