CVE-2022-2067: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.1
Published: 2022-06-13T13:15Z
Repository: https://github.com/francoisjacquet/rosariosis
Language: PHP
Files changed: CHANGES.md, modules/Custom/includes/RegistrationSave.fnc.php, modules/School_Setup/Calendar.php, modules/School_Setup/MarkingPeriods.php, modules/School_Setup/SchoolFields.php, modules/Students/includes/AddressFields.php, modules/Students/includes/PeopleFields.php, modules/Students/includes/StudentFields.php, modules/Users/UserFields.php
Commit date: 2022-04-25 14:02:16 +0200
Commit message: Fix SQL injection escape DB identifier

Diff: diff --git a/CHANGES.md b/CHANGES.md
index 9382457f2..7b0969cbb 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -51,10 +51,11 @@ Changes in 9.0
 - Fix SQL error duplicate key value violates unique constraint "attendance_calendar_pkey" in Calendar.php
 - Fix PHP fatal error Unsupported operand types in ListOutput.php
 - Add AttrEscape() function in Inputs.php
 - Use AttrEscape() instead of htmlspecialchars(), program wide
 - Maintain Advanced search when editing Timeframe in Percent.php
+- Fix SQL injection escape DB identifier in RegistrationSave.fnc.php, Calendar.php, MarkingPeriods.php, SchoolFields.php, AddressFields.php, PeopleFields.php, StudentFields.php & UserFields.php
 
 Changes in 8.9.4
 ----------------
 - Fix SQL injection sanitize all `$_REQUEST` keys in Warehouse.php, thanks to @nhienit2010
 - Fix reflected XSS via mime-type in FileUpload.fnc.php, thanks to @nhienit2010
diff --git a/modules/Custom/includes/RegistrationSave.fnc.php b/modules/Custom/includes/RegistrationSave.fnc.php
index 30b334e36..9b3205565 100644
--- a/modules/Custom/includes/RegistrationSave.fnc.php
+++ b/modules/Custom/includes/RegistrationSave.fnc.php
@@ -405,11 +405,11 @@ function RegistrationSaveContactNameFields( $config, $values )
 			}
 
 			if ( ! empty( $value )
 				|| $value == '0' )
 			{
-				$fields .= $column . ',';
+				$fields .= DBEscapeIdentifier( $column ) . ',';
 
 				$values_sql .= "'" . $value . "',";
 			}
 		}
 	}
diff --git a/modules/School_Setup/Calendar.php b/modules/School_Setup/Calendar.php
index d84d6cabb..1667e7ef7 100644
--- a/modules/School_Setup/Calendar.php
+++ b/modules/School_Setup/Calendar.php
@@ -498,11 +498,11 @@ if ( $_REQUEST['modfunc'] === 'detail' )
 					foreach ( (array) $_REQUEST['values'] as $column => $value )
 					{
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 							$values .= "'" . $value . "',";
 							$go = true;
 						}
 					}
 
diff --git a/modules/School_Setup/MarkingPeriods.php b/modules/School_Setup/MarkingPeriods.php
index 0f798c23f..bd40b3cdc 100644
--- a/modules/School_Setup/MarkingPeriods.php
+++ b/modules/School_Setup/MarkingPeriods.php
@@ -202,11 +202,11 @@ if ( ! empty( $_POST['tables'] )
 				}
 
 				if ( ! empty( $value )
 					|| $value === '0' )
 				{
-					$fields .= $column . ',';
+					$fields .= DBEscapeIdentifier( $column ) . ',';
 
 					$values .= "'" . $value . "',";
 
 					$go = true;
 				}
diff --git a/modules/School_Setup/SchoolFields.php b/modules/School_Setup/SchoolFields.php
index 6fe7127bc..f0b85cb1c 100644
--- a/modules/School_Setup/SchoolFields.php
+++ b/modules/School_Setup/SchoolFields.php
@@ -71,11 +71,11 @@ if ( isset( $_POST['tables'] )
 					foreach ( (array) $columns as $column => $value )
 					{
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 
 							$values .= "'" . $value . "',";
 
 							$go = true;
 						}
diff --git a/modules/Students/includes/AddressFields.php b/modules/Students/includes/AddressFields.php
index 47076f898..cf5dd7769 100644
--- a/modules/Students/includes/AddressFields.php
+++ b/modules/Students/includes/AddressFields.php
@@ -89,11 +89,11 @@ if ( isset( $_POST['tables'] )
 					foreach ( (array) $columns as $column => $value )
 					{
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 
 							$values .= "'" . $value . "',";
 
 							$go = true;
 						}
diff --git a/modules/Students/includes/PeopleFields.php b/modules/Students/includes/PeopleFields.php
index 7598c62e7..bb6b54adc 100644
--- a/modules/Students/includes/PeopleFields.php
+++ b/modules/Students/includes/PeopleFields.php
@@ -89,11 +89,11 @@ if ( isset( $_POST['tables'] )
 					foreach ( (array) $columns as $column => $value )
 					{
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 
 							$values .= "'" . $value . "',";
 
 							$go = true;
 						}
diff --git a/modules/Students/includes/StudentFields.php b/modules/Students/includes/StudentFields.php
index ec9124bb9..5585e9402 100644
--- a/modules/Students/includes/StudentFields.php
+++ b/modules/Students/includes/StudentFields.php
@@ -123,11 +123,11 @@ if ( isset( $_POST['tables'] )
 					foreach ( (array) $columns as $column => $value )
 					{
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 
 							$values .= "'" . $value . "',";
 
 							$go = true;
 						}
diff --git a/modules/Users/UserFields.php b/modules/Users/UserFields.php
index c359edbff..dda5bf5fe 100644
--- a/modules/Users/UserFields.php
+++ b/modules/Users/UserFields.php
@@ -132,11 +132,11 @@ if ( isset( $_POST['tables'] )
 					foreach ( (array) $columns as $column => $value )
 					{
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 
 							$values .= "'" . $value . "',";
 
 							$go = true;
 						}

Vulnerable code: 				$fields .= $column . ',';
							$fields .= $column . ',';
					$fields .= $column . ',';
							$fields .= $column . ',';
							$fields .= $column . ',';
							$fields .= $column . ',';
							$fields .= $column . ',';
							$fields .= $column . ',';
Fixed code: - Fix SQL injection escape DB identifier in RegistrationSave.fnc.php, Calendar.php, MarkingPeriods.php, SchoolFields.php, AddressFields.php, PeopleFields.php, StudentFields.php & UserFields.php
				$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';
					$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';
							$fields .= DBEscapeIdentifier( $column ) . ',';