CVE-2020-14443: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2020-06-18T18:15Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/accountancy/customer/card.php, htdocs/accountancy/expensereport/card.php, htdocs/accountancy/supplier/card.php, htdocs/comm/mailing/info.php, htdocs/compta/paiement/info.php, htdocs/variants/ajax/get_attribute_values.php
Commit date: 2020-06-15 15:08:52 +0200
Commit message: FIX BlindBoolean SQL injection reported by Christian Weiler
<sak1.s3curity@gmail.com>
Diff: diff --git a/htdocs/accountancy/customer/card.php b/htdocs/accountancy/customer/card.php
index 0a39fbc82546..591606a7e26c 100644
--- a/htdocs/accountancy/customer/card.php
+++ b/htdocs/accountancy/customer/card.php
@@ -32,12 +32,12 @@ $langs->loadLangs(array("bills", "accountancy"));
 
 $action = GETPOST('action', 'alpha');
 $cancel = GETPOST('cancel', 'alpha');
 $backtopage = GETPOST('backtopage', 'alpha');
 
-$codeventil = GETPOST('codeventil');
-$id = GETPOST('id');
+$codeventil = GETPOST('codeventil', 'int');
+$id = GETPOST('id', 'int');
 
 // Security check
 if ($user->socid > 0)
 	accessforbidden();
 
diff --git a/htdocs/accountancy/expensereport/card.php b/htdocs/accountancy/expensereport/card.php
index 36d587e0c99c..9d7c504354f3 100644
--- a/htdocs/accountancy/expensereport/card.php
+++ b/htdocs/accountancy/expensereport/card.php
@@ -36,12 +36,12 @@ $langs->loadLangs(array("bills", "accountancy", "trips"));
 
 $action = GETPOST('action', 'alpha');
 $cancel = GETPOST('cancel', 'alpha');
 $backtopage = GETPOST('backtopage', 'alpha');
 
-$codeventil = GETPOST('codeventil');
-$id = GETPOST('id');
+$codeventil = GETPOST('codeventil', 'int');
+$id = GETPOST('id', 'int');
 
 // Security check
 if ($user->socid > 0)
 	accessforbidden();
 
diff --git a/htdocs/accountancy/supplier/card.php b/htdocs/accountancy/supplier/card.php
index 6140f90fe8d7..699459ad63a8 100644
--- a/htdocs/accountancy/supplier/card.php
+++ b/htdocs/accountancy/supplier/card.php
@@ -36,12 +36,12 @@ $langs->loadLangs(array("bills", "accountancy"));
 
 $action = GETPOST('action', 'alpha');
 $cancel = GETPOST('cancel', 'alpha');
 $backtopage = GETPOST('backtopage', 'alpha');
 
-$codeventil = GETPOST('codeventil');
-$id = GETPOST('id');
+$codeventil = GETPOST('codeventil', 'int');
+$id = GETPOST('id', 'int');
 
 // Security check
 if ($user->socid > 0)
 	accessforbidden();
 
diff --git a/htdocs/comm/mailing/info.php b/htdocs/comm/mailing/info.php
index 3dfe0c4264c1..070d46f61047 100644
--- a/htdocs/comm/mailing/info.php
+++ b/htdocs/comm/mailing/info.php
@@ -25,11 +25,11 @@
 require '../../main.inc.php';
 require_once DOL_DOCUMENT_ROOT.'/comm/mailing/class/mailing.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/emailing.lib.php';
 
-$id = GETPOST('id');
+$id = GETPOST('id', 'int');
 
 // Load translation files required by the page
 $langs->load("mails");
 
 // Security check
diff --git a/htdocs/compta/paiement/info.php b/htdocs/compta/paiement/info.php
index 3da6a95a1e84..00c3440b8681 100644
--- a/htdocs/compta/paiement/info.php
+++ b/htdocs/compta/paiement/info.php
@@ -29,11 +29,11 @@ require_once DOL_DOCUMENT_ROOT.'/compta/paiement/class/paiement.class.php';
 require_once DOL_DOCUMENT_ROOT.'/core/lib/payments.lib.php';
 
 // Load translation files required by the page
 $langs->loadLangs(array('bills', 'companies'));
 
-$id = GETPOST('id');
+$id = GETPOST('id', 'int');
 $ref = GETPOST('ref', 'alpha');
 $action = GETPOST('action', 'alpha');
 $confirm = GETPOST('confirm', 'alpha');
 
 /*
diff --git a/htdocs/variants/ajax/get_attribute_values.php b/htdocs/variants/ajax/get_attribute_values.php
index 866bac1ef78d..ee45ad18b23f 100644
--- a/htdocs/variants/ajax/get_attribute_values.php
+++ b/htdocs/variants/ajax/get_attribute_values.php
@@ -26,11 +26,11 @@ require_once DOL_DOCUMENT_ROOT.'/product/class/product.class.php';
 require_once DOL_DOCUMENT_ROOT.'/variants/class/ProductAttribute.class.php';
 require_once DOL_DOCUMENT_ROOT.'/variants/class/ProductAttributeValue.class.php';
 
 header('Content-Type: application/json');
 
-$id = GETPOST('id');
+$id = GETPOST('id', 'int');
 
 if (!$id) {
     print json_encode(array(
         'error' => 'ID not set'
     ));

Vulnerable code: $codeventil = GETPOST('codeventil');
$id = GETPOST('id');
$codeventil = GETPOST('codeventil');
$id = GETPOST('id');
$codeventil = GETPOST('codeventil');
$id = GETPOST('id');
$id = GETPOST('id');
$id = GETPOST('id');
$id = GETPOST('id');
Fixed code: $codeventil = GETPOST('codeventil', 'int');
$id = GETPOST('id', 'int');
$codeventil = GETPOST('codeventil', 'int');
$id = GETPOST('id', 'int');
$codeventil = GETPOST('codeventil', 'int');
$id = GETPOST('id', 'int');
$id = GETPOST('id', 'int');
$id = GETPOST('id', 'int');
$id = GETPOST('id', 'int');