hitoshura25/cvefixes huggingface dataset:
CVE-2016-7565 (PHP, published 2017-02-13T18:59Z)
Description: value: install/index.php in Exponent CMS 2.3.9 allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
install/index.php
Commit message: security fix to prevent possible hacking by moving security checks earlier in the install code


Vulnerable code:

//            $value = expString::sanitize($value);
//            'c'          => expString::sanitize($_REQUEST['sc']),
// Make sure our 'page' is set correctly
if (file_exists("../framework/conf/config.php") && !isset($_REQUEST['page'])) {
    $_REQUEST['page'] = 'upgrade-1';
}
if (!file_exists("../framework/conf/config.php") && !isset($_REQUEST['page'])) {
    $_REQUEST['page'] = 'welcome';
}
$page = $_REQUEST['page'];

// Superadmin must be logged in to do an upgrade
if (strpos($page, 'upgrade-') !== false && empty($user->is_admin)) {
    header('Location: ../index.php');
    exit();
}

// Only run installation if not already installed
if (strpos($page, 'upgrade-') === false && !file_exists(BASE . 'install/not_configured')) {
    header('Location: ../index.php');
    exit();
}

?>

Fixed code:
// Make sure our 'page' is set correctly and prevent running under most circumstances
if (file_exists("../framework/conf/config.php") && !isset($_REQUEST['page'])) {
    $_REQUEST['page'] = 'upgrade-1';
}
if (!file_exists("../framework/conf/config.php") && !isset($_REQUEST['page'])) {
    $_REQUEST['page'] = 'welcome';
}
$page = $_REQUEST['page'];

// Superadmin must be logged in to do an upgrade
if (strpos($page, 'upgrade-') !== false && empty($user->isSuperAdmin())) {
    header('Location: ../index.php');
    exit();
}

// Only run installation if not already installed
if (strpos($page, 'upgrade-') === false && !file_exists(BASE . 'install/not_configured')) {
    header('Location: ../index.php');
    exit();
}

    if (!empty($_REQUEST['install_sample']) && (strpos($_REQUEST['install_sample'], '..') !== false || strpos($_REQUEST['install_sample'], '/') !== false)) {
        header('Location: ../index.php');
        exit();  // attempt to hack the site
    }
?>
CVE-2016-8898 (PHP, published 2019-05-24T17:29Z)
Description: value: Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/core/subsystems/expRouter.php
Commit message: remove warning from expRouter code


Vulnerable code:
            if (is_string($var) && strrpos($key,'_id',-3) !== false) {

Fixed code:
            if (is_string($var) && strlen($key) >= 3 && strrpos($key,'_id',-3) !== false) {
CVE-2016-9134 (PHP, published 2016-11-03T10:59Z)
Description: value: Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/core/subsystems/expPaginator.php
Commit message: regression fix last vulnerability fix for sanitizing order/direction params


Vulnerable code:
        $this->order = empty($params['order']) ? 'id' : preg_replace('/[^a-z\_]/i','',$params['order']);
        if(!preg_match('/[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*/', $this->order))

Fixed code:
//        $this->order = empty($params['order']) ? 'id' : preg_replace('/[^a-zAZ_]/','',$params['order']);
        $this->order = empty($params['order']) ? 'id' : expString::escape($params['order']);
        // filter out invalid order & direction
        if(preg_match('/[^a-zA-Z_][^a-zA-Z0-9_]*/', $this->order))
CVE-2016-9134 (PHP, published 2016-11-03T10:59Z)
Description: value: Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/core/subsystems/expPaginator.php
Commit message: regression fix last vulnerability fix for sanitizing order/direction params


Vulnerable code:
        $this->order = empty($params['order']) ? 'id' : preg_replace('/[^a-z\_]/i','',$params['order']);
        if(!preg_match('/[a-zA-Z_\x7f-\xff][a-zA-Z0-9_\x7f-\xff]*/', $this->order))

Fixed code:
//        $this->order = empty($params['order']) ? 'id' : preg_replace('/[^a-zAZ_]/','',$params['order']);
        $this->order = empty($params['order']) ? 'id' : expString::escape($params['order']);
        // filter out invalid order & direction
        if(preg_match('/[^a-zA-Z_][^a-zA-Z0-9_]*/', $this->order))
CVE-2016-9134 (PHP, published 2016-11-03T10:59Z)
Description: value: Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/core/subsystems/expPaginator.php
framework/modules/help/controllers/helpController.php
Commit message: fix 2 vulnerabilities reported by felixk3y


Vulnerable code:
		$this->order = empty($params['order']) ? 'id' : expString::escape($params['order']);

Fixed code:
        $this->order = empty($params['order']) ? 'id' : preg_replace('/[^a-z\_]/i','',$params['order']);
                $params['version'] = expString::escape($params['version']);
CVE-2016-9134 (PHP, published 2016-11-03T10:59Z)
Description: value: Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/core/subsystems/expPaginator.php
framework/modules/help/controllers/helpController.php
Commit message: fix 2 vulnerabilities reported by felixk3y


Vulnerable code:
		$this->order = empty($params['order']) ? 'id' : expString::escape($params['order']);

Fixed code:
        $this->order = empty($params['order']) ? 'id' : preg_replace('/[^a-z\_]/i','',$params['order']);
                $params['version'] = expString::escape($params['version']);
CVE-2016-9135 (PHP, published 2016-11-03T10:59Z)
Description: value: Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impact is Information Disclosure.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/core/subsystems/expPaginator.php
framework/modules/help/controllers/helpController.php
Commit message: fix 2 vulnerabilities reported by felixk3y


Vulnerable code:
		$this->order = empty($params['order']) ? 'id' : expString::escape($params['order']);

Fixed code:
        $this->order = empty($params['order']) ? 'id' : preg_replace('/[^a-z\_]/i','',$params['order']);
                $params['version'] = expString::escape($params['version']);
CVE-2016-9135 (PHP, published 2016-11-03T10:59Z)
Description: value: Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impact is Information Disclosure.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/core/subsystems/expPaginator.php
framework/modules/help/controllers/helpController.php
Commit message: fix 2 vulnerabilities reported by felixk3y


Vulnerable code:
		$this->order = empty($params['order']) ? 'id' : expString::escape($params['order']);

Fixed code:
        $this->order = empty($params['order']) ? 'id' : preg_replace('/[^a-z\_]/i','',$params['order']);
                $params['version'] = expString::escape($params['version']);
CVE-2016-9183 (PHP, published 2016-11-04T10:59Z)
Description: value: In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class mysqli_database uses the injectProof method to prevent SQL injection, but this filter can be bypassed easily: it only sanitizes user input if there are odd numbers of ' or " characters. Impact is Information Disclosure.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/core/controllers/expHTMLEditorController.php
framework/modules/ecommerce/controllers/orderController.php
Commit message: fix security vulnerability in order search and editor preview; reported by fyth


Vulnerable code:
            $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);

Fixed code:
            $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));
        $this->params['query'] = expString::escape($this->params['query']);
        $this->params['query'] = expString::escape($this->params['query']);
CVE-2016-9184 (PHP, published 2016-11-04T10:59Z)
Description: value: In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impact is Information Disclosure.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/core/controllers/expHTMLEditorController.php
Commit message: better fix security vulnerability in editor preview; reported by fyth


Vulnerable code:
            $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));

Fixed code:
        } else {
            $this->params['editor'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['editor']);
            $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);
CVE-2016-9184 (PHP, published 2016-11-04T10:59Z)
Description: value: In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impact is Information Disclosure.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/core/controllers/expHTMLEditorController.php
Commit message: better fix security vulnerability in editor preview; reported by fyth


Vulnerable code:
            $demo = self::getEditorSettings($this->params['id'], expString::escape($this->params['editor']));

Fixed code:
        } else {
            $this->params['editor'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['editor']);
            $demo = self::getEditorSettings($this->params['id'], $this->params['editor']);
CVE-2016-9242 (PHP, published 2016-11-07T11:59Z)
Description: value: Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) content_type or (2) subtype parameter.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/core/controllers/expRatingController.php
Commit message: fix security vulnerability in ratings; reported by fyth


Vulnerable code:

Fixed code:


        $this->params['content_type'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['content_type']);
        $this->params['subtype'] = preg_replace("/[^[:alnum:][:space:]]/u", '', $this->params['subtype']);
CVE-2016-9272 (PHP, published 2016-11-11T11:59Z)
Description: value: A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/core/controllers/expController.php
Commit message: fix sql injection security vulnerability; reported by Nicky [#1394 state:resolved] [#1395 state:resolved]


Vulnerable code:
            $obj = new $modelname($id);

Fixed code:
            $obj = new $modelname(intval($id));
CVE-2016-9282 (PHP, published 2016-11-11T22:59Z)
Description: value: SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote attackers to read database information via action=search&module=search with the search_string parameter.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/search/controllers/searchController.php
Commit message: fix security vulnerability in search method, reported by pang0lin


Vulnerable code:
        $terms = htmlspecialchars($terms);

Fixed code:
        $terms = expString::escape(htmlspecialchars($terms));
CVE-2016-9284 (PHP, published 2016-11-11T22:59Z)
Description: value: getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via users/getUsersByJSON/sort/ and a trailing string.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/users/controllers/usersController.php
Commit message: fix security vulnerability to get user list, reported by pang0lin


Vulnerable code:

Fixed code:
        'getUsersByJSON'   => 'Get Users',
CVE-2016-9285 (PHP, published 2016-11-11T22:59Z)
Description: value: framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via a modified id number, as demonstrated by address/edit/id/1, related to an "addresses, countries, and regions" issue.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/addressbook/controllers/addressController.php
Commit message: fix security vulnerability to editing addresses, countries, and regions; reported by pang0lin


Vulnerable code:
        'process' => 'Import External Addresses'
        if((isset($this->params['id']))) $record = new address(intval($this->params['id']));
        else $record = null;
		expQueue::flashIfNotLoggedIn('message',gt('You must be logged in to manage your address book.'));

Fixed code:
        'process' => 'Import External Addresses',
        'edit_country' => 'Edit Country',
        'delete_country' => 'Delete Country',
        'update_country' => 'Update Country',
        'edit_region' => 'Edit Region',
        'delete_region' => 'Delete Region',
        'update_region' => 'Update Region',
        'edit'=>'You must be logged in to perform this action',
        global $user;

        $id = !empty($this->params['id']) ? $this->params['id'] : null;

        // check to see if we should be editing.  You either need to be an admin, or editing own account.
        if ($user->isAdmin() || ($user->id == $id)) {
            $record = new address($id);
        } else {
            flash('error', gt('You do not have the proper permissions to edit this address'));
            expHistory::back();
        }

		expQueue::flashIfNotLoggedIn('message',gt('You must be logged in to manage your address book.'));  //fixme is this redundant to common routine?
CVE-2016-9286 (PHP, published 2016-11-11T22:59Z)
Description: value: framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read address information, as demonstrated by an address/show/id/1 URI.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
framework/modules/users/controllers/usersController.php
Commit message: Prevent logged in uses from view other user records and admins from super-admin records; thanks to pang0lin


Vulnerable code:

Fixed code:
    public function show() {
        global $user;

        $id = !empty($this->params['id']) ? $this->params['id'] : null;

        // check to see if we should be editing.  You either need to be an admin, or viewing own account.
        if ($user->isAdmin() || ($user->id == $id)) {
            $u = new user($id);
            if ($u->isSuperAdmin() && $user->isActingAdmin()) {
                flash('error', gt('You do not have the proper permissions to view this record'));
                expHistory::back();
            }
            parent::show();
        } else {
            flash('error', gt('You do not have the proper permissions to view this record'));
            expHistory::back();
        }
    }