CVE-2016-7780 (PHP, published 2017-03-07T16:59Z)
Description: value: SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/exponentcms/exponent-cms
Files changed:
cron/find_help.php
framework/modules/ecommerce/controllers/cartController.php
framework/modules/ecommerce/controllers/purchaseOrderController.php
framework/modules/ecommerce/controllers/storeController.php
framework/modules/file/controllers/fileController.php
framework/modules/users/controllers/usersController.php
Commit message: second effort to greatly enhance system security (xss, sql inject, file exploit, rce, etc...), thanks to felixk3y


Vulnerable code:
            $version = $db->selectValue('help_version', 'id', 'version="' . expString::sanitize($_GET['version']) . '"');
                    /*if ($quantity < $child->minimum_order_quantity)                       
                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity . 
                        
                //$newqty = $item->product->updateQuantity($this->params['value']);                  
                //}                           
                /*eDebug($item->quantity);   
                eDebug($item->product->quantity); 
                eDebug($qCheck);                  
                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';                        
            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to 
            //{    
                // get all current discount codes that are valid and applied                
            // save out the cart total to the database		
        $discount = $discount->getCouponByName($this->params['coupon_code']);
            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));       
        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));                           
        //group items by type and id               
        //eDebug($order,true); 
        
        
        $options = array();  
                
                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;                      
        
			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . $this->params['vendor']);
        $id = isset($this->params['title']) ? $this->params['title'] : $this->params['id'];
        $product = new product(addslashes($this->params['title']));
        $model = $product->find("first", 'model="' . $this->params['model'] . '"');
        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? $this->params['cat'] : 0);
        $terms = $this->params['search_string'];
            $results = $this->params['results'];
            $startIndex = $this->params['startIndex'];
                $sort = $this->params['sort'];
            $results = $this->params['results'];
            $startIndex = $this->params['startIndex'];
            $sort = $this->params['sort'];
//            $this->params['query'] = $this->params['query'];


Fixed code:
            $version = $db->selectValue('help_version', 'id', 'version="' . expString::escape($_GET['version']) . '"');
                    /*if ($quantity < $child->minimum_order_quantity)
                        flash('message', $child->title . " - " . $child->model . " has a minimum order quantity of " . $child->minimum_order_quantity .

                //$newqty = $item->product->updateQuantity($this->params['value']);
                //}
                /*eDebug($item->quantity);
                eDebug($item->product->quantity);
                eDebug($qCheck);
                        /*$updates->message = $item->products_name.' only has '.$item->product->quantity.' on hand. You can not add any more to your cart.';
            //to something other than 0, then we have, but we'll set the estimtae to shipping_total to
            //{
                // get all current discount codes that are valid and applied
            // save out the cart total to the database
        $discount = $discount->getCouponByName(expString::escape($this->params['coupon_code']));
            //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
        //redirect_to(array('controller'=>'cart', 'action'=>'checkout'));
        //group items by type and id
        //eDebug($order,true);


        $options = array();

                    $cost = $selected_option->updown == '+' ? $cost : $cost * -1;

			$purchase_orders = $this->purchase_order->find('all', 'vendor_id=' . expString::escape($this->params['vendor']));
        $id = isset($this->params['title']) ? expString::escape($this->params['title']) : $this->params['id'];
        $product = new product(expString::escape($this->params['title']));
        $model = $product->find("first", 'model="' . expString::escape($this->params['model']) . '"');
        $parent = !empty($catid) ? $catid : (!empty($this->params['cat']) ? intval($this->params['cat']) : 0);
        $terms = expString::escape($this->params['search_string']);
        $this->params['query'] = expString::escape($this->params['query']);
        $this->params['query'] = expString::escape($this->params['query']);

        $this->params['query'] = expString::escape($this->params['query']);
            $results = intval($this->params['results']);
            $startIndex = intval($this->params['startIndex']);
                $sort = expString::escape($this->params['sort']);
            $this->params['query'] = expString::escape($this->params['query']);
            $results = intval($this->params['results']);
            $startIndex = intval($this->params['startIndex']);
            $sort = expString::escape($this->params['sort']);
            $this->params['query'] = expString::escape($this->params['query']);