CVE-2015-10064: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in VictorFerraresi pokemon-database-php. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named dd0e1e6cdf648d6a3deff441f515bcb1d7573d68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218455.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-17T19:15Z
Repository: https://github.com/VictorFerraresi/pokemon-database-php
Language: PHP
Files changed: addStrike.php, editStrike.php, golpes.php, validateRegister.php
Commit date: 2015-05-06 09:36:28 -0300
Commit message: Removida a vulnerabilidade do site à SQL Injection.
Diff: diff --git a/addStrike.php b/addStrike.php
index 6572dfc..c18b4aa 100644
--- a/addStrike.php
+++ b/addStrike.php
@@ -6,18 +6,20 @@ if(isset($_POST['submit'])){
     tryAddStrike($_POST['name'], $_POST['dmg'], $_POST['type']);
 }
 else {
     header("location:./");
 }
-function tryAddStrike($name, $damage, $type){     
-    $result = mysql_query("SELECT * FROM `pokemon`.`golpes` WHERE name = '$name' LIMIT 1");    
+function tryAddStrike($name, $damage, $type){   
+    $ename = mysql_real_escape_string($name);
+    $edamage = mysql_real_escape_string($damage);
+    $result = mysql_query("SELECT * FROM `pokemon`.`golpes` WHERE name = '$ename' LIMIT 1");    
 
     if(mysql_num_rows($result) >= 1){ //Se ja existir o golpe
         $_SESSION['error'] = 1;
         header("location:acp.php");
     } else {
-        $result = mysql_query("INSERT INTO `pokemon`.`golpes` (`name`, `damage`, `type`) VALUES ('$name', '$damage', '$type')");            
+        $result = mysql_query("INSERT INTO `pokemon`.`golpes` (`name`, `damage`, `type`) VALUES ('$ename', '$edamage', '$type')");            
         $_SESSION['error'] = 2; //Apesar do nome da variável da sessão, é uma instrução apenas
         header("location:acp.php");
     }
 }
 ?>
diff --git a/editStrike.php b/editStrike.php
index 25b1fe0..e7a0717 100644
--- a/editStrike.php
+++ b/editStrike.php
@@ -7,18 +7,19 @@ if(isset($_POST['submit'])){
 }
 else {
     header("location:./");
 }
 function tryEditStrike($id, $name, $damage, $type){ 
-
+    $ename = mysql_real_escape_string($name);
+    $edamage = mysql_real_escape_string($damage);
     $result = mysql_query("SELECT * FROM `pokemon`.`golpes` WHERE id = '$id' LIMIT 1");    
 
     if(mysql_num_rows($result) == 0){ //Se não existir golpe com este ID
         $_SESSION['error2'] = 3;
         header("location:acp.php");
     } else {
-        $result = mysql_query("UPDATE `pokemon`.`golpes` SET `name` = '$name', `damage` = '$damage', `type` = '$type' WHERE `id` = '$id'");            
+        $result = mysql_query("UPDATE `pokemon`.`golpes` SET `name` = '$ename', `damage` = '$edamage', `type` = '$type' WHERE `id` = '$id'");            
         $_SESSION['error2'] = 4; //Apesar do nome da variável da sessão, é uma instrução apenas
         header("location:acp.php");
     }
 }
 ?>
diff --git a/golpes.php b/golpes.php
index 8cd2d84..05d463c 100644
--- a/golpes.php
+++ b/golpes.php
@@ -1,9 +1,10 @@
 <?php
-    require 'mysqlcon.php';     
+    require 'mysqlcon.php';       
     $a = $_GET["golpe"];
-    $sth = mysql_query("SELECT `name` FROM `pokemon`.`golpes` where name like '" . $a."%'");
+    $ea = mysql_real_escape_string($a);
+    $sth = mysql_query("SELECT `name` FROM `pokemon`.`golpes` where name like '" . $ea."%'");
     $rows = array();
     while($r = mysql_fetch_assoc($sth)) {
         $rows[] = $r;
     }
     print json_encode($rows);
diff --git a/validateRegister.php b/validateRegister.php
index 303c45a..83e54f5 100644
--- a/validateRegister.php
+++ b/validateRegister.php
@@ -14,24 +14,26 @@ if(isset($_POST['submit'])){
     }
 }
 else {
     header("location:./");
 }
-function tryRegister($user, $email, $pass){     
-    $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE user = '$user' LIMIT 1");    
+function tryRegister($user, $email, $pass){   
+    $euser = mysql_real_escape_string($user);
+    $eemail = mysql_real_escape_string($email);
+    $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE user = '$euser' LIMIT 1");    
 
     if(mysql_num_rows($result) >= 1){ //Se ja existir o usuário
         $_SESSION['error'] = 2;
         header("location:register.php");
     } else {
-        $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE email = '$email' LIMIT 1");
+        $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE email = '$eemail' LIMIT 1");
         if(mysql_num_rows($result) >= 1){ //Se ja existir o email
             $_SESSION['error'] = 3;
             header("location:register.php");
         } else { //Se a conta estiver 100% apta ao registro
             //Inserimos a conta no banco de dados
-            $result = mysql_query("INSERT INTO `pokemon`.`usuarios` (`user`, `email`, `password`) VALUES ('$user', '$email', '$pass')");            
+            $result = mysql_query("INSERT INTO `pokemon`.`usuarios` (`user`, `email`, `password`) VALUES ('$euser', '$eemail', '$pass')");            
             $_SESSION['error'] = 2; //Apesar do nome da variável da sessão, é uma instrução apenas
             header("location:login.php");
         }
     }
 }

Vulnerable code: function tryAddStrike($name, $damage, $type){     
    $result = mysql_query("SELECT * FROM `pokemon`.`golpes` WHERE name = '$name' LIMIT 1");    
        $result = mysql_query("INSERT INTO `pokemon`.`golpes` (`name`, `damage`, `type`) VALUES ('$name', '$damage', '$type')");            

        $result = mysql_query("UPDATE `pokemon`.`golpes` SET `name` = '$name', `damage` = '$damage', `type` = '$type' WHERE `id` = '$id'");            
    require 'mysqlcon.php';     
    $sth = mysql_query("SELECT `name` FROM `pokemon`.`golpes` where name like '" . $a."%'");
function tryRegister($user, $email, $pass){     
    $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE user = '$user' LIMIT 1");    
        $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE email = '$email' LIMIT 1");
            $result = mysql_query("INSERT INTO `pokemon`.`usuarios` (`user`, `email`, `password`) VALUES ('$user', '$email', '$pass')");            
Fixed code: function tryAddStrike($name, $damage, $type){   
    $ename = mysql_real_escape_string($name);
    $edamage = mysql_real_escape_string($damage);
    $result = mysql_query("SELECT * FROM `pokemon`.`golpes` WHERE name = '$ename' LIMIT 1");    
        $result = mysql_query("INSERT INTO `pokemon`.`golpes` (`name`, `damage`, `type`) VALUES ('$ename', '$edamage', '$type')");            
    $ename = mysql_real_escape_string($name);
    $edamage = mysql_real_escape_string($damage);
        $result = mysql_query("UPDATE `pokemon`.`golpes` SET `name` = '$ename', `damage` = '$edamage', `type` = '$type' WHERE `id` = '$id'");            
    require 'mysqlcon.php';       
    $ea = mysql_real_escape_string($a);
    $sth = mysql_query("SELECT `name` FROM `pokemon`.`golpes` where name like '" . $ea."%'");
function tryRegister($user, $email, $pass){   
    $euser = mysql_real_escape_string($user);
    $eemail = mysql_real_escape_string($email);
    $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE user = '$euser' LIMIT 1");    
        $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE email = '$eemail' LIMIT 1");
            $result = mysql_query("INSERT INTO `pokemon`.`usuarios` (`user`, `email`, `password`) VALUES ('$euser', '$eemail', '$pass')");