CVE-2023-1211: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.2
Published: 2023-03-07T00:15Z
Repository: https://github.com/phpipam/phpipam
Language: PHP
Files changed: functions/classes/class.Admin.php, misc/CHANGELOG
Commit date: 2023-03-05 22:32:48 +0000
Commit message: Bugfix: SQL injection in custom field enum/set types

Reported by Peng Zhou @zpbrent

Diff: diff --git a/functions/classes/class.Admin.php b/functions/classes/class.Admin.php
index f5fa9cef6..d2f5d8c82 100644
--- a/functions/classes/class.Admin.php
+++ b/functions/classes/class.Admin.php
@@ -671,11 +671,11 @@ class Admin extends Common_functions {
 			return false;
 		}
 
 	    # set type definition and size of needed
 	    if($field['fieldType']=="bool" || $field['fieldType']=="text" || $field['fieldType']=="date" || $field['fieldType']=="datetime")	{ $field['ftype'] = $field['fieldType']; }
-	    else																																{ $field['ftype'] = $field['fieldType']."(".$field['fieldSize'].")"; }
+	    else																																{ $field['ftype'] = $field['fieldType']."( :enumset )"; }
 
 	    # default value null
 	    $field['fieldDefault'] = is_blank($field['fieldDefault']) ? NULL : $field['fieldDefault'];
 
 	    # character set if needed
@@ -707,10 +707,11 @@ class Admin extends Common_functions {
 
 	    # set parametized values
 	    $params = array();
 	    if (strpos($query, ":default")>0)	$params['default'] = $field['fieldDefault'];
 	    if (strpos($query, ":comment")>0)	$params['comment'] = $field['Comment'];
+	    if (strpos($query, ":enumset")>0)	$params['enumset'] = $field['fieldSize'];
 
 		# execute
 		try { $res = $this->Database->runQuery($query, $params); }
 		catch (Exception $e) {
 			$this->Result->show("danger", _("Error: ").$e->getMessage(), false);
diff --git a/misc/CHANGELOG b/misc/CHANGELOG
index 34821ae35..2cfd553d7 100755
--- a/misc/CHANGELOG
+++ b/misc/CHANGELOG
@@ -5,10 +5,11 @@
     + php8.1 compatibility (php8.x support is work-in-progress);
     + MySQL 5.5.3+ is now required (support for utf8mb4);
 
     Security Fixes:
     ----------------------------
+    + SQL injection in custom field enum/set types;
     + XSS (reflected) in 'bw-calulator-result.php';
     + XSS (reflected) by invalid email address response;
     + XSS (reflected) by /app/tools/subnet-masks/popup.php (#3738);
     + XSS and LDAP injection in ad-search-result.php;
     + XSS and LDAP injection in ad-search-group-result.php;

Vulnerable code: 	    else																																{ $field['ftype'] = $field['fieldType']."(".$field['fieldSize'].")"; }
Fixed code: 	    else																																{ $field['ftype'] = $field['fieldType']."( :enumset )"; }
	    if (strpos($query, ":enumset")>0)	$params['enumset'] = $field['fieldSize'];
    + SQL injection in custom field enum/set types;