CVE-2023-46727 (PHP, published 2023-12-13T19:15Z)
Description: value: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/glpi-project/glpi
Files changed:
src/RuleImportAsset.php
tests/functional/Glpi/Inventory/Assets/Bios.php
tests/functional/Glpi/Inventory/Inventory.php
Commit message: Merge pull request from GHSA-v799-2mp3-wgfr

Add test cases

Vulnerable code:
            $this->handleFieldsCriteria($item, $it_criteria, $input);
      <SSN>ggheb7ne7</SSN>
            'serial' => 'ggheb7ne7',
      <SSN>ggheb7ne7</SSN>

Fixed code:
use Glpi\Toolbox\Sanitizer;

            $this->handleFieldsCriteria($item, $it_criteria, Sanitizer::sanitize($input));
      <SSN>ggheb7'ne7</SSN>
            'serial' => addslashes("ggheb7'ne7"),
      <SSN>ggheb7'ne7</SSN>
        //- ensure existing instances has been updated
        $databases = $database->getDatabases();
        $this->array($databases)->hasSize(2);
        $this->array(array_pop($databases))
            ->string['name']->isIdenticalTo('new_database')
            ->integer['size']->isIdenticalTo(2048);
        $this->array(array_pop($databases))
            ->string['name']->isIdenticalTo('glpi')
            ->integer['size']->isIdenticalTo(55000);

        //test sql syntax error
        $json = json_decode(file_get_contents(self::INV_FIXTURES . 'computer_2_partial_dbs.json'));
        $mysql = $json->content->databases_services[0];
        //update version
        $mysql->name = "Maria'DB";
        $dbs = $mysql->databases;

        $db_glpi = &$dbs[0];
        $db_glpi->size = 55000;
        $db_glpi->last_backup_date = '2021-06-25 08:52:44';

        $db_new = &$dbs[1];
        $db_new->name = 'new_database';
        $db_new->size = 2048;

        $services = [$mysql];
        $json->content->databases_services = $services;

        $this->doInventory($json);

        //check created databases & instances
        $this->integer(countElementsInTable(\DatabaseInstance::getTable(), ['is_deleted' => 0]))->isIdenticalTo(1);
        $this->integer(countElementsInTable(\DatabaseInstance::getTable(), ['is_deleted' => 1]))->isIdenticalTo(2);

        //ensure database version has been updated
        $database = new \DatabaseInstance();
        $this->boolean($database->getFromDBByCrit(['name' => 'MariaDB']))->isTrue();
        $this->string($database->fields['version'])->isIdenticalTo('Ver 15.1 Distrib 10.5.10-MariaDB-modified');