CVE-2014-125063 (PHP, published 2023-01-07T19:15Z)
Description: value: A vulnerability was found in ada-l0velace Bid and classified as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is abd71140b8219fa8741d0d8a57ab27d5bfd34222. It is recommended to apply a patch to fix this issue. The identifier VDB-217625 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/ada-l0velace/Bid
Files changed:
js/ajax_forms.js
lance.php
leilao.php
Commit message: sql injection problems solved


Vulnerable code:
					alert(error.html());
					//console.log("Error not found");
	$ultimolance_query="SELECT MAX(lance.valor) AS max_valor 
	$ultimolance = $connection->query($ultimolance_query);
	$ultimolance = $connection->query($ultimolance_query);

						  WHERE leilaor.lid = $lid 
		$valorbase = $connection->query($valorbase_query);
		$result = $connection->query($lance_query);
		
		echo($lance_query);
		if (!$result) {
	 		echo("<div id='erro'> Não houve lance:($sql) </div>");
	//regista a pessoa no leilão. Exemplificativo apenas.....
	$inscreve_query = "INSERT INTO concorrente (pessoa,leilao) 
				       VALUES ($nif,$lid)";
					  WHERE lid =" . $lid;
	$resultado = $connection->query($sqlDataLeilao);

	if (!$resultado) {
		echo("<p> Erro na Query:($sql) </p>");
			$inscreve = $connection->query($inscreve_query);
			if (!$inscreve) {

Fixed code:
					//alert(data);
					if(error.html() != undefined)
						alert(error.html());
					console.log("Error not found");
	/*$ultimolance_query="SELECT MAX(lance.valor) AS max_valor 
	$ultimolance = $connection->query($ultimolance_query);*/
	$ultimolance = $connection->prepare("SELECT MAX(lance.valor) AS max_valor 
	                    FROM lance 
	                    WHERE lance.leilao = :lid");
	$ultimolance->bindParam(':lid', $lid);
	$ultimolance->setFetchMode(PDO::FETCH_ASSOC);
	$ultimolance->execute();
	$ultimolance = $ultimolance->fetchAll();
	
	//$ultimolance = $connection->query($ultimolance_query);
	
						  WHERE leilaor.lid = :lid 
		$valorbase = $connection->prepare($valorbase_query);
		$valorbase->bindParam(':lid', $lid);
		$valorbase->execute();
		$result = $connection->prepare($lance_query);
		$error = $result->execute();
		//echo($lance_query);
		if (!$error) {
	 		echo("<div id='erro'> Não houve lance:($error) </div>");
	
					  WHERE lid =:lid";
	$resultado = $connection->prepare($sqlDataLeilao);
	$resultado->bindParam(':lid', $lid);
	$error = $resultado->execute();
	if (!$error) {
		echo("<div id='erro'> Erro na Query:($sql) </div>");

	//regista a pessoa no leilão. Exemplificativo apenas.....
	$inscreve_query = "INSERT INTO concorrente (pessoa,leilao) 
				       VALUES (:nif,:lid)";
			$inscreve = $connection->prepare($inscreve_query);
			$inscreve->bindParam(':nif', $nif);
			$inscreve->bindParam(':lid', $lid);
			$error = $inscreve->execute();
			if (!$error) {