CVE-2015-10046 (PHP, published 2023-01-15T10:15Z)
Description: value: A vulnerability has been found in lolfeedback and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The identifier of the patch is 6cf0b5f2228cd8765f734badd37910051000f2b2. It is recommended to apply a patch to fix this issue. The identifier VDB-218353 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/philipblaquiere/lolfeedback
Files changed:
application/controllers/home.php
application/controllers/register.php
application/controllers/review.php
application/controllers/summoner.php
application/libraries/Recent_games.php
application/models/review_model.php
application/views/comments.php
application/views/include/footer.php
application/views/include/header.php
application/views/recent_games.php
application/views/summoner.php
assets/css/custom.css
assets/js/custom.js
Commit message: prevent review sql injection, removed uness


Vulnerable code:
		$this->view_wrapper('home');
    $this->view_wrapper('register');
      $this->view_wrapper('home');
            if(array_key_exists($i, $games[self::LOL_GAMES]))
		VALUES ('" . $review['id'] . "','" . $review['fromid'] . "','" . $review['from_name'] . "','" . $review['toid'] . "','" . $review['gameid'] . "')";
		$this->db1->query($sql);
				SET $skill = '$skill_value'
				WHERE id = '$reviewid'";
		$result = $this->db1->query($sql);
				SET message = '$message'
				WHERE id = '$reviewid'";
		$result = $this->db1->query($sql);
		$sql = "SELECT * FROM reviews 

				OR skill4 != 0)";
  			</div><!-- Container -->
  		</div><!-- Wrap -->
<body>
  <div id="wrap">
  <!-- Content -->
<?php if(empty($games)) { ?>
<span class="open_sans">No matches have been played</span>
<?php } ?>
<?php foreach ($games as $game) { ?>

<div class="lol-match row">
	<div class="col-md-9">
		<table class="table table-condensed">
			<th class="col-md-1"/>
			<th class="col-md-3"></th>
			<th>Player</th>
			<?php foreach ($game['100'] as $player) { ?>
				<tr>
					<td>
						<?php if(isset($player['championSprite'])) { ?>
						<img src="<?php echo $player['championSprite'] ?>" class="img-responsive" alt="Responsive image">
						<?php } ?>
					</td>
					<td >
						<div class="lol-match-player-name">
							<strong><?php echo $player['name'] ?></strong>
						</div>
					</td>
				</tr>
			<?php } ?>
		</table>
		<table class="table table-condensed">
			<th class="col-md-1"/>
			<th class="col-md-3"></th>
			<th>Player</th>
			<?php foreach ($game['200'] as $player) { ?>
				<tr>
					<td>
						<?php if(isset($player['championSprite'])) { ?>
						<img src="<?php echo $player['championSprite'] ?>" class="img-responsive" alt="Responsive image">
						<?php } ?>
					</td>
					<td >
						<div class="lol-match-player-name">
							<strong><?php echo $player['name'] ?></strong>
						</div>
					</td>
				</tr>
			<?php } ?>
		</table>
	</div>
</div>
<?php } ?>
<div class="page-header">
  <h1>Account Registration - League of Legends</h1>
  <h4><small>To begin linking your League of Legends account to our website, start by entering your League of Legends summoner name. Only one can be linked to an account at any given time. FYI: We'll never ask you for any League of Legends password.</small></h4>
</div>

<h2>Step 1 : Enter Summoner Name</h3>
<!-- Ajax Call -> controllers/ajax/authenticate_summoner -->
<?php echo form_open('',array('class' => 'form-horizontal padded_10', 'id' => 'lolSummonerRegistrationForm')); ?>
  <div class="form-group">
    <?php echo form_label('Summoner Name', 'summonername', array('class' => 'col-sm-2 control-label')); ?>
    <div class="col-sm-10">
      <div class="input-group">
        <div class="input-group-btn">
          <button type="button" class="btn btn-default dropdown-toggle" id="region" data-toggle="dropdown">Region <span class="caret"></span></button>
          <ul class="dropdown-menu region-list">
            <li><a href="#">NA</a></li>
          </ul>
        </div><!-- /btn-group -->
        <?php echo form_input(array('name' => 'summonername','id' => 'summonername', 'class' => 'form-control', 'placeholder' => 'Summoner Name')); ?>
      </div><!-- /input-group -->
    </div>
  </div>
  <div class="form-group">
    <div class="col-sm-1 col-sm-offset-3">
      <?php echo form_submit('submit', 'Find', "class='btn btn-default'"); ?>
    </div>
    <div class="col-sm-7" id="summoner_validation_error">
    </div>
  </div>
<?php echo form_close(); ?>

<div id="authenticate_runepage_page">
  <!-- Validation Content -->
</div>
<div class="row">
  <div class="col-md-4"></div>
  <div class="col-md-4">
  	<?php echo form_open('search', array('class' => 'form-horizontal', 'id' => 'search_summoner')); ?>
  		<div class="input-group">
		      <?php echo form_input(array('name' => 'search', 'class' => 'form-control', 'placeholder' => 'Search Summoner', 'id' => 'search_textbox')); ?>
        <span class="input-group-btn">
          <button type="submit" class="btn btn-default">Search</button>
        </span>
		  </div>
	<?php echo form_close(); ?>
  </div>
  <div class="col-md-4"></div>
</div>
<div class="summoner-games">
<div class="summoner-reviews">
  <div class="row">
    <div class="reviews-title">
      <p></p>
    </div>
  </div>
  <div class="row">
    <div class="col-md-7">
    <div class="reviews-content">
      <?php if(empty($reviews)) { ?>
        <p>No reviews left for <?php echo $title ?></p>
        <?php } else { foreach ($reviews as $review) { ?>
            <div class="review-header">
              <p>
                <a href="<?php echo site_url('summoner')."/".$review['fromid'] ?>"><?php echo $review['from_name'] ?></a>:
                <?php if($review['skill1'] != 0) { ?>.
                  Game-sense-<?php echo $review['skill1'] ?>
                <?php } if($review['skill2'] != 0) { ?>
                  Helpful-<?php echo $review['skill2'] ?>
                <?php } if($review['skill3'] != 0) { ?>
                  Skillful-<?php echo $review['skill4'] ?>
                <?php } if($review['skill4'] != 0) { ?>
                  Delivery-<?php echo $review['skill4'] ?>
                <?php } ?>
                <?php echo $review['created'] ?>
              </p>
            </div>
            <div class="review-body">
              <?php if($review['message'] != NULL) { ?>
              <p><?php echo $review['message']?></p>
              <?php } ?>
            </div>
        <?php } } ?>
      </div>
    </div>
  </div>
function reloadLoLRegister(message) {
    alert("in reload");
    $.ajax({
        url: '/LoLRep/add_esport/register_LoL',
        type: "post",
        data: {},
        success: function(data){
            $("#authenticate_runepage_page").html(message);
        }
    });
}

Fixed code:
		$data['page'] = "home";
		$this->view_wrapper('home', $data);
    $data['page'] = "register";
    $this->view_wrapper('register', $data);
      $data['page'] = "home";
      $this->view_wrapper('home', $data);

	public function get($id)
	{
		$data['reviews'] = $this->review_model->get($id);
		$this->load->view('comments', $data);
	}
				$data['id'] = $id;
			$data['summonerid'] = $id;
			$data['page'] = "summoner";
            if($games != null && array_key_exists($i, $games[self::LOL_GAMES]))
		VALUES (?,?,?,?,?)";
		$this->db1->query($sql, array($review['id'], $review['fromid'], $review['from_name'], $review['toid'], $review['gameid']));
				SET $skill = ?
				WHERE id = ?";
		$result = $this->db1->query($sql, array($skill_value, $reviewid));
				SET message = ?
				WHERE id = ?";
		$result = $this->db1->query($sql, array($message, $reviewid));
		$sql = "SELECT * FROM reviews
				OR skill4 != 0)
				ORDER BY created DESC";
<div class="row">
    <div class="reviews-title">
      <p></p>
    </div>
  </div>
  <div class="row">
    <div class="col-md-7">
    <div class="reviews-content">
      <?php if(empty($reviews)) { ?>
        <p>No reviews</p>
        <?php } else { foreach ($reviews as $review) { ?>
            <div class="review-header">
              <p>
                <a href="<?php echo site_url('summoner')."/".$review['fromid'] ?>"><?php echo $review['from_name'] ?></a>:
                <?php if($review['skill1'] != 0) { ?>
                Game-sense-<?php echo $review['skill1'] ?>
                <?php } if($review['skill2'] != 0) { ?>
                  Helpful-<?php echo $review['skill2'] ?>
                <?php } if($review['skill3'] != 0) { ?>
                  Skillful-<?php echo $review['skill4'] ?>
                <?php } if($review['skill4'] != 0) { ?>
                  Delivery-<?php echo $review['skill4'] ?>
                <?php } ?>
                <?php echo $review['created'] ?>
              </p>
            </div>
            <div class="review-body">
              <?php if($review['message'] != NULL) { ?>
              <p><?php echo $review['message']?></p>
              <?php } ?>
            </div>
        <?php } } ?>
      </div>
    </div>
  </div>
  		</div><!-- Container -->
<body <?php if($page == "summoner") { ?>id="<?php echo $summonerid ?>" <?php } ?> class="<?php echo $page ?>">
  <!--   -->
<div id="sg_<?php echo $id ?>" class="summoner-games">
<div id="sr_<?php echo $id ?>" class="summoner-reviews">

.review-body{
  margin-top: -5px;
  padding-bottom: 5px;
}

$(document).ready(function() {
    if($('body').is('.summoner')){

        var summonerId = document.getElementsByTagName("body")[0].id
        $("#sr_"+summonerId).html('<div class="row"><div class="col-md-1 col-md-offset-5"><div class="spinner"><i class="fa-li fa fa-spinner fa-spin fa-2x"></i></div></div></div>');

        $.ajax({
        url: "/perfect/index.php/review/get/"+summonerId,
        type: 'POST',
        data: {},
        success: function(data){
            $("#sr_"+summonerId).html();
            $("#sr_"+summonerId).html(data);
        },
        error:function(jqXHR, textStatus, errorThrown){
            $("#"+buttonId).html('An error has occured creating the review:' + textStatus +errorThrown);
            return;
        }
    });
  }
});