CVE-2013-10012 (Perl, published 2023-01-16T11:15Z)
Description: value: A vulnerability, which was classified as critical, was found in antonbolling clan7ups. Affected is an unknown function of the component Login/Session. The manipulation leads to sql injection. The name of the patch is 25afad571c488291033958d845830ba0a1710764. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218388.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/antonbolling/clan7ups
Files changed:
www/cgi-bin/login.pl
www/cgi-bin/session.pl
Commit message: this codebase is riddled with sql injection vulnerabilities; fix some of the key vulnerabilities in login/session code


Vulnerable code:
$sth = $dbh->prepare("select id from users where name='$login' and pass=PASSWORD('$pass')");
$sth->execute;
my $valid_login = $sth->rows;
my ($uid) = $sth->fetchrow_array;
  my $sth = $dbh->prepare("select unix_timestamp(now())");
  $sth->execute;
  my ($time) = $sth->fetchrow_array;
  $dbh->do("update users set magic=$magic where id=$uid");
  $dbh->do("update users set session_stamp=now() where id=$uid");
  my $sth = $dbh->prepare("select magic, UNIX_TIMESTAMP(now())-UNIX_TIMESTAMP(session_stamp) as elapsed from users where id=$uid");
  $sth->execute;
    $dbh->do("update users set session_stamp=now(), magic=$new_magic where id=$uid");
    # Put magic into cgi query.
#    my $vars = $q->Vars;
#    $vars->{'magic'} = $new_magic;
    # Successfully continued session...
  my $sth = $dbh->prepare("select access from users where id=$uid");
  $sth->execute;
  my $sth = $dbh->prepare("insert into log (user,action,cdata1) values($uid,'accessdenied','$action')");
  $sth->execute;
  my $sth = $dbh->prepare("select magic from users where id=$uid");
  $sth->execute;

Fixed code:
my $login_sql = $dbh->prepare("select id from users where name=? and pass=PASSWORD(?)");
$login_sql->execute($login,$pass);
my $valid_login = $login_sql->rows;
my ($uid) = $login_sql->fetchrow_array;
  my $time_sql = $dbh->prepare("select unix_timestamp(now())");
  $time_sql->execute;
  my ($time) = $time_sql->fetchrow_array;
  my $sql = $dbh->prepare("update users set magic=? where id=?");
	$sql->execute($magic,$uid);
  $sql = $dbh->prepare("update users set session_stamp=now() where id=?");
	$sql->execute($uid);
  my $sth = $dbh->prepare("select magic, UNIX_TIMESTAMP(now())-UNIX_TIMESTAMP(session_stamp) as elapsed from users where id=?");
  $sth->execute($uid);
    my $sql = $dbh->prepare("update users set session_stamp=now(), magic=? where id=?");
		$sql->execute($new_magic,$uid);
  my $sth = $dbh->prepare("select access from users where id=?");
  $sth->execute($uid);
  my $sth = $dbh->prepare("insert into log (user,action,cdata1) values(?,'accessdenied','$action')");
  $sth->execute($uid);
  my $sth = $dbh->prepare("select magic from users where id=?");
  $sth->execute($uid);