CVE-2018-25070: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical. This vulnerability affects the function csv.Read of the file plugins/extras/p5.mysql/NonQuery.cs of the component CSV Import. The manipulation leads to sql injection. Upgrading to version 8.3 is able to address this issue. The patch is identified as c179a3d0703db55cfe0cb939b89593f2e7a87246. It is recommended to upgrade the affected component. VDB-217606 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-07T11:15Z
Repository: https://github.com/polterguy/phosphorusfive
Language: C#
Files changed: plugins/extras/p5.mysql/NonQuery.cs
Commit date: 2018-06-06 12:32:35 +0300
Commit message: Sanity checking column names in [p5.mysql.load-from]

To avoid a maliciously malformed CSV file from creating SQL injection …

Diff: diff --git a/plugins/extras/p5.mysql/NonQuery.cs b/plugins/extras/p5.mysql/NonQuery.cs
index e5536271..51b719fc 100644
--- a/plugins/extras/p5.mysql/NonQuery.cs
+++ b/plugins/extras/p5.mysql/NonQuery.cs
@@ -160,15 +160,21 @@ namespace p5.mysql
 
         /*
          * Helper for above.
          */
         private static string CreateInsertSQL (string table, Dictionary<string, MySqlDbType> types, string [] headers)
-        {
+        {
             // Creating our reused insert SQL command text.
             var insertSql = string.Format ("insert into `{0}` (", table);
             var first = true;
-            foreach (var idxHeader in headers) {
+            foreach (var idxHeader in headers) {
+                
+                // Sanity checking column name
+                foreach (var idxChar in idxHeader) {
+                    if ("0123456789_-abcdefghijklmnopqrstuvwxyz".IndexOf (idxChar.ToString ().ToLower (CultureInfo.InvariantCulture), StringComparison.InvariantCulture) == -1)
+                        throw new System.Security.SecurityException ("Unsupported and insecure column name found in your CSV file.");
+                }
 
                 // Skipping TIMESTAMP columns.
                 if (types [idxHeader] == MySqlDbType.Timestamp)
                     continue;
                 if (first)

Vulnerable code:         {
            foreach (var idxHeader in headers) {
Fixed code:         {
            foreach (var idxHeader in headers) {
                
                // Sanity checking column name
                foreach (var idxChar in idxHeader) {
                    if ("0123456789_-abcdefghijklmnopqrstuvwxyz".IndexOf (idxChar.ToString ().ToLower (CultureInfo.InvariantCulture), StringComparison.InvariantCulture) == -1)
                        throw new System.Security.SecurityException ("Unsupported and insecure column name found in your CSV file.");
                }