CVE-2017-20169: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability, which was classified as critical, has been found in GGGGGGGG ToN-MasterServer. Affected by this issue is some unknown functionality of the file public_html/irc_updater/svr_request_pub.php. The manipulation leads to sql injection. The patch is identified as 3a4c7e6d51bf95760820e3245e06c6e321a7168a. It is recommended to apply a patch to fix this issue. VDB-218306 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-13T21:15Z
Repository: https://github.com/GGGGGGGG/ToN-MasterServer
Language: PHP
Files changed: common/config.php, public_html/irc_updater/svr_request_pub.php
Commit date: 2017-12-19 21:07:30 -0500
Commit message: protection against sql injections

Diff: diff --git a/common/config.php b/common/config.php
index b2499a9..c0e62b9 100755
--- a/common/config.php
+++ b/common/config.php
@@ -4,10 +4,9 @@ $config['db']['host'] = "127.0.0.1";
 $config['db']['username'] = "masterserver";
 $config['db']['password'] = trim(file_get_contents('/var/www/masterserver1.talesofnewerth.com/dbp'));
 $config['db']['database'] = "masterserver";
 $config['db']['patchesdb'] = "patches";
 $config['hash'] = "abcdefgh";
-$config['isProxy'] = True;
 $config['public_url'] = "s2.michaelk.ch.localhost";
 $patchesdbcon = NULL;
 $dbcon = NULL;
 ?>
diff --git a/public_html/irc_updater/svr_request_pub.php b/public_html/irc_updater/svr_request_pub.php
index ed28fd3..5ba658f 100755
--- a/public_html/irc_updater/svr_request_pub.php
+++ b/public_html/irc_updater/svr_request_pub.php
@@ -28,29 +28,30 @@ function handle_get_online()
 }
 
 /* Add a server */
 function handle_set_online()
 {
+	global $dbcon;
+
 	/* Sanitize input */
-	$ip = $_SERVER["REMOTE_ADDR"];
-	$port = intval(post_input("port"));
-	$num_conn = intval(post_input("num_conn"));
-	$max_conn = intval(post_input("num_max"));
-	$name = post_input("name");
-	$desc = post_input("desc");
-	$status = post_input("status");
-	$minkarma = post_input("minkarma");
-	$location = post_input("location");
-	$cgt = post_input("cgt");
-	$next_map = post_input("next_map");
-	$map = post_input("map");
-	$login = post_input("login");
-	$pass = post_input("pass");
-	$minlevel = intval(post_input("minlevel"));
-	$maxlevel = intval(post_input("maxlevel"));
+	$ip = mysqli_real_escape_string($dbcon, $_SERVER["REMOTE_ADDR"]);
+	$port = mysqli_real_escape_string($dbcon,intval(post_input("port")));
+	$num_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_conn")));
+	$max_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_max")));
+	$name = mysqli_real_escape_string($dbcon, post_input("name"));
+	$desc = mysqli_real_escape_string($dbcon, post_input("desc"));
+	$status = mysqli_real_escape_string($dbcon, post_input("status"));
+	$minkarma = mysqli_real_escape_string($dbcon, post_input("minkarma"));
+	$location = mysqli_real_escape_string($dbcon, post_input("location"));
+	$cgt = mysqli_real_escape_string($dbcon, post_input("cgt"));
+	$next_map = mysqli_real_escape_string($dbcon, post_input("next_map"));
+	$map = mysqli_real_escape_string($dbcon, post_input("map"));
+	$login = mysqli_real_escape_string($dbcon, post_input("login"));
+	$pass = mysqli_real_escape_string($dbcon, post_input("pass"));
+	$minlevel = mysqli_real_escape_string($dbcon, intval(post_input("minlevel")));
+	$maxlevel = mysqli_real_escape_string($dbcon, intval(post_input("maxlevel")));
 	/* authenticate server */
-	global $config;
 	$data = array();
 	$isOfficial = False;
 
 	if($isOfficial) {
 		// this shouldn't happen! generate server id if not returned by official masterserver
@@ -73,11 +74,10 @@ function handle_set_online()
 		ON DUPLICATE KEY UPDATE
 			official = '$official', id = $server_id, ip = '$ip', port = $port, num_conn = $num_conn, max_conn = $max_conn, name = '$name', 
 			description = '$desc', minlevel = $minlevel, 
 			maxlevel = $maxlevel, updated = NOW(), online = 1";
 
-	global $dbcon;		
 	mysqli_query($dbcon, $query);
 
 
 	/* Send id in answer */
 	$id = mysqli_insert_id($dbcon);
@@ -92,13 +92,14 @@ function handle_set_online()
 }
 
 /* Save accounts on a server */
 function handle_set_online_ids()
 {
+	global $dbcon;
 	/* Update number of connections */
-	$num_conn = intval(post_input("num_conn"));
-	$login = post_input("login");
+	$num_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_conn")));
+	$login = mysqli_real_escape_string($dbcon, post_input("login"));
 	$query = "
 		UPDATE servers SET
 			num_conn = $num_conn,
 			updated = NOW()
 		WHERE
@@ -112,11 +113,11 @@ function handle_set_online_ids()
 function handle_shutdown()
 {
 	global $dbcon;
 
 	/* Remove server from list */
-	$id = intval(post_input("server_id"));
+	$id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
 	$query = "
 		UPDATE servers SET num_conn = 0, updated = NOW(), online = 0
 		WHERE
 			id = $id";
 	mysqli_query($dbcon, $query);
@@ -128,17 +129,17 @@ function handle_shutdown()
 /* User joins a server */
 function handle_c_conn() 
 {
 	global $dbcon;
 
-	$account_id = intval(post_input("account_id"));
-	$server_id = intval(post_input("server_id"));
-	$c_conn['account_id'] = post_input("account_id");
-	$c_conn['server_id'] = post_input("server_id");
-	$c_conn['num_conn'] = post_input("num_conn");
-	$c_conn['cookie'] = post_input("cookie");
-	$c_conn['ip'] = post_input("ip");
+	$account_id = mysqli_real_escape_string($dbcon, intval(post_input("account_id")));
+	$server_id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
+	$c_conn['account_id'] = mysqli_real_escape_string($dbcon, post_input("account_id"));
+	$c_conn['server_id'] = mysqli_real_escape_string($dbcon, post_input("server_id"));
+	$c_conn['num_conn'] = mysqli_real_escape_string($dbcon, post_input("num_conn"));
+	$c_conn['cookie'] = mysqli_real_escape_string($dbcon, post_input("cookie"));
+	$c_conn['ip'] = mysqli_real_escape_string($dbcon, post_input("ip"));
 
 	$cookie = $c_conn['cookie'];
 
 	/* first attempt to verify cookie on unofficial MS */
 	$result = db_query("SELECT username FROM users WHERE id = $account_id AND cookie = '$cookie'");
@@ -159,10 +160,11 @@ function handle_c_conn()
 			online = 1
 		ON DUPLICATE KEY UPDATE
 			server = {$server_id},
 			updated = NOW(),
 			online = 1";
+
 	db_query($query);
 
 	$query = "SELECT username from users where id = $account_id";
 	$result = mysqli_query($dbcon, $query);
 	$row = mysqli_fetch_assoc($result);
@@ -172,12 +174,14 @@ function handle_c_conn()
 }
 
 /* User disconnects a server */
 function handle_c_disc() 
 {
-	$account_id = intval(post_input("account_id"));
-	$server_id = intval(post_input("server_id"));
+	global $dbcon;
+
+	$account_id = mysqli_real_escape_string($dbcon, intval(post_input("account_id")));
+	$server_id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
 	
 	$query = "
 		UPDATE
 			player
 		SET
@@ -195,16 +199,18 @@ function handle_c_disc()
 }
 
 /* Server start game */
 function handle_auth()
 {
-	$a['login'] = post_input('login');
-	$a['pass'] = post_input('pass');
-	$a['type'] = post_input('type'); // = "reg"
-	$a['port'] = post_input('port');
-	$a['map'] = post_input('map');
-	$a['account_ids'] = $_POST['account_id'];
+	global $dbcon;
+
+	$a['login'] = mysqli_real_escape_string($dbcon, post_input('login'));
+	$a['pass'] = mysqli_real_escape_string($dbcon, post_input('pass'));
+	$a['type'] = mysqli_real_escape_string($dbcon, post_input('type')); // = "reg"
+	$a['port'] = mysqli_real_escape_string($dbcon,post_input('port'));
+	$a['map'] = mysqli_real_escape_string($dbcon, post_input('map'));
+	$a['account_ids'] = mysqli_real_escape_string($dbcon, $_POST['account_id']);
 
 
 	/* temporary default values for now */
 	$reserv = '0';
 	$salt = '2mP';

Vulnerable code: $config['isProxy'] = True;
	$ip = $_SERVER["REMOTE_ADDR"];
	$port = intval(post_input("port"));
	$num_conn = intval(post_input("num_conn"));
	$max_conn = intval(post_input("num_max"));
	$name = post_input("name");
	$desc = post_input("desc");
	$status = post_input("status");
	$minkarma = post_input("minkarma");
	$location = post_input("location");
	$cgt = post_input("cgt");
	$next_map = post_input("next_map");
	$map = post_input("map");
	$login = post_input("login");
	$pass = post_input("pass");
	$minlevel = intval(post_input("minlevel"));
	$maxlevel = intval(post_input("maxlevel"));
	global $config;
	global $dbcon;		
	$num_conn = intval(post_input("num_conn"));
	$login = post_input("login");
	$id = intval(post_input("server_id"));
	$account_id = intval(post_input("account_id"));
	$server_id = intval(post_input("server_id"));
	$c_conn['account_id'] = post_input("account_id");
	$c_conn['server_id'] = post_input("server_id");
	$c_conn['num_conn'] = post_input("num_conn");
	$c_conn['cookie'] = post_input("cookie");
	$c_conn['ip'] = post_input("ip");
	$account_id = intval(post_input("account_id"));
	$server_id = intval(post_input("server_id"));
	$a['login'] = post_input('login');
	$a['pass'] = post_input('pass');
	$a['type'] = post_input('type'); // = "reg"
	$a['port'] = post_input('port');
	$a['map'] = post_input('map');
	$a['account_ids'] = $_POST['account_id'];
Fixed code: 	global $dbcon;

	$ip = mysqli_real_escape_string($dbcon, $_SERVER["REMOTE_ADDR"]);
	$port = mysqli_real_escape_string($dbcon,intval(post_input("port")));
	$num_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_conn")));
	$max_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_max")));
	$name = mysqli_real_escape_string($dbcon, post_input("name"));
	$desc = mysqli_real_escape_string($dbcon, post_input("desc"));
	$status = mysqli_real_escape_string($dbcon, post_input("status"));
	$minkarma = mysqli_real_escape_string($dbcon, post_input("minkarma"));
	$location = mysqli_real_escape_string($dbcon, post_input("location"));
	$cgt = mysqli_real_escape_string($dbcon, post_input("cgt"));
	$next_map = mysqli_real_escape_string($dbcon, post_input("next_map"));
	$map = mysqli_real_escape_string($dbcon, post_input("map"));
	$login = mysqli_real_escape_string($dbcon, post_input("login"));
	$pass = mysqli_real_escape_string($dbcon, post_input("pass"));
	$minlevel = mysqli_real_escape_string($dbcon, intval(post_input("minlevel")));
	$maxlevel = mysqli_real_escape_string($dbcon, intval(post_input("maxlevel")));
	global $dbcon;
	$num_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_conn")));
	$login = mysqli_real_escape_string($dbcon, post_input("login"));
	$id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
	$account_id = mysqli_real_escape_string($dbcon, intval(post_input("account_id")));
	$server_id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
	$c_conn['account_id'] = mysqli_real_escape_string($dbcon, post_input("account_id"));
	$c_conn['server_id'] = mysqli_real_escape_string($dbcon, post_input("server_id"));
	$c_conn['num_conn'] = mysqli_real_escape_string($dbcon, post_input("num_conn"));
	$c_conn['cookie'] = mysqli_real_escape_string($dbcon, post_input("cookie"));
	$c_conn['ip'] = mysqli_real_escape_string($dbcon, post_input("ip"));

	global $dbcon;

	$account_id = mysqli_real_escape_string($dbcon, intval(post_input("account_id")));
	$server_id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
	global $dbcon;

	$a['login'] = mysqli_real_escape_string($dbcon, post_input('login'));
	$a['pass'] = mysqli_real_escape_string($dbcon, post_input('pass'));
	$a['type'] = mysqli_real_escape_string($dbcon, post_input('type')); // = "reg"
	$a['port'] = mysqli_real_escape_string($dbcon,post_input('port'));
	$a['map'] = mysqli_real_escape_string($dbcon, post_input('map'));
	$a['account_ids'] = mysqli_real_escape_string($dbcon, $_POST['account_id']);