CVE-2019-20107: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2020-03-05T13:15Z
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Language: PHP
Files changed: lib/plan/newest_tcversions.php, lib/plan/planUpdateTC.php
Commit date: 2019-12-30 09:54:11 +0100
Commit message: fix: security #8829

Diff: diff --git a/lib/plan/newest_tcversions.php b/lib/plan/newest_tcversions.php
index 10307620f..8079e52d5 100644
--- a/lib/plan/newest_tcversions.php
+++ b/lib/plan/newest_tcversions.php
@@ -86,15 +86,16 @@ function init_args()
 {
 	$_REQUEST = strings_stripSlashes($_REQUEST);
     
     $args = new stdClass();
     $args->user_id = $_SESSION['userID'];
-    $args->tproject_id = $_SESSION['testprojectID'];
+    $args->tproject_id = intval($_SESSION['testprojectID']);
     $args->tproject_name = $_SESSION['testprojectName'];
     
     $args->tplan_id = isset($_REQUEST['tplan_id']) ? $_REQUEST['tplan_id'] : $_SESSION['testplanID'];
-    
+    $args->tplan_id = intval($args->tplan_id);
+
     $args->id = isset($_REQUEST['id']) ? $_REQUEST['id'] : null;
     $args->version_id = isset($_REQUEST['version_id']) ? $_REQUEST['version_id'] : 0;
     $args->level = isset($_REQUEST['level']) ? $_REQUEST['level'] : null;
     
     // Can be a list (string with , (comma) has item separator), 
diff --git a/lib/plan/planUpdateTC.php b/lib/plan/planUpdateTC.php
index d67075ba9..063ceeec5 100644
--- a/lib/plan/planUpdateTC.php
+++ b/lib/plan/planUpdateTC.php
@@ -112,11 +112,11 @@ $smarty->display($templateCfg->template_dir . $templateCfg->default_template);
 */
 function init_args(&$tplanMgr)
 {
     $_REQUEST = strings_stripSlashes($_REQUEST);
     $args = new stdClass();
-    $args->id = isset($_REQUEST['id']) ? $_REQUEST['id'] : null;
+    $args->id = isset($_REQUEST['id']) ? intval($_REQUEST['id']) : null;
     $args->level = isset($_REQUEST['level']) ? $_REQUEST['level'] : null;
     $args->doAction = isset($_REQUEST['doAction']) ? $_REQUEST['doAction'] : null;
 
     // Maps with key: test case ID value: tcversion_id
     $args->fullTestCaseSet = isset($_REQUEST['a_tcid']) ? $_REQUEST['a_tcid'] : null;

Vulnerable code:     $args->tproject_id = $_SESSION['testprojectID'];
    
    $args->id = isset($_REQUEST['id']) ? $_REQUEST['id'] : null;
Fixed code:     $args->tproject_id = intval($_SESSION['testprojectID']);
    $args->tplan_id = intval($args->tplan_id);

    $args->id = isset($_REQUEST['id']) ? intval($_REQUEST['id']) : null;