CVE-2023-4188 (PHP, published 2023-08-05T20:15Z)
Description: value:  SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
Severity: nan (CVSS v3 base score: 9.1)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/instantsoft/icms2
Files changed:
system/controllers/admin/actions/menu_tree_ajax.php
system/controllers/tags/actions/autocomplete.php
system/core/user.php
system/fields/string.php
system/libs/template.helper.php
templates/admincoreui/assets/ui/form.tpl.php
templates/admincoreui/assets/ui/grid-perms.tpl.php
templates/admincoreui/controllers/admin/menu.tpl.php
templates/default/assets/ui/confirm.tpl.php
templates/default/assets/ui/filter-panel.tpl.php
templates/default/assets/ui/form.tpl.php
templates/default/assets/ui/grid-perms.tpl.php
templates/modern/assets/ui/filter-panel.tpl.php
templates/modern/assets/ui/form.tpl.php
Commit message: Vulnerabilities fixed, thanks to huntr.dev

Vulnerable code:
                    'title'  => $item['title'],
        $term = $this->request->get('term', '');
                select("(LEFT(`tag`, " . mb_strlen($term) . ") = '{$term}')", 'tag_order')->
    public static function login($email, $password, $remember = false, $complete_login = true) {
        $model = cmsCore::getModel('users');
    if ($type === 'password') {
<form id="<?php html($attributes['form_id']); ?>" action="<?php echo $attributes['action']; ?>"
<form action="<?php echo $submit_url; ?>" method="post">
                        <?php echo $menu['title']; ?>
    <form action="<?php echo $confirm_action; ?>" method="post" onsubmit="$(this).find('.button-submit').addClass('disabled is-busy');">
        <form action="<?php echo $form_url; ?>" method="get" id="<?php echo $form_id; ?>" accept-charset="utf-8">
<form id="<?php html($attributes['form_id']); ?>" action="<?php echo $attributes['action']; ?>"
<form action="<?php echo $submit_url; ?>" method="post">
        <form action="<?php echo $form_url; ?>" method="get" id="<?php echo $form_id; ?>" accept-charset="utf-8">
<form id="<?php html($attributes['form_id']); ?>" action="<?php echo $attributes['action']; ?>"

Fixed code:
                    'title'  => html($item['title'], false),
        $term = strip_tags($this->request->get('term', ''));
                select("(LEFT(`tag`, " . mb_strlen($term) . ") = '".$this->model->db->escape($term)."')", 'tag_order')->
    public static function login($email, $password, $remember = false, $complete_login = true, $model = null) {
        if($model === null) {
            $model = cmsCore::getModel('users');
        }

            // Разрешены HTML теги, - прогоняем через типограф
            $value = cmsEventsManager::hook('html_filter', [
                'text'                => $value,
                'is_auto_br'          => false,
                'build_smiles'        => false,
                'build_redirect_link' => false
            ]);

    if ($type === 'password' && empty($attributes['autocomplete'])) {
<form id="<?php html($attributes['form_id']); ?>" action="<?php html($attributes['action']); ?>"
<form action="<?php html($submit_url); ?>" method="post">
                        <?php html($menu['title']); ?>
    <form action="<?php html($confirm_action); ?>" method="post" onsubmit="$(this).find('.button-submit').addClass('disabled is-busy');">
        <form action="<?php html($form_url); ?>" method="get" id="<?php echo $form_id; ?>" accept-charset="utf-8">
<form id="<?php html($attributes['form_id']); ?>" action="<?php html($attributes['action']); ?>"
<form action="<?php html($submit_url); ?>" method="post">
        <form action="<?php html($form_url); ?>" method="get" id="<?php html($form_id); ?>" accept-charset="utf-8">
<form id="<?php html($attributes['form_id']); ?>" action="<?php html($attributes['action']); ?>"