CVE-2022-0754 (PHP, published 2022-03-07T13:15Z)
Description: value: SQL Injection in GitHub repository salesagility/suitecrm prior to 7.12.5.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/salesagility/suitecrm
Files changed:
README.md
files.md5
modules/AOR_Scheduled_Reports/AOR_Scheduled_Reports.php
modules/Calendar/CalendarActivity.php
modules/Employees/Employee.php
modules/ModuleBuilder/Module/IconRepository.php
modules/ProspectLists/Duplicate.php
modules/Users/User.php
modules/vCals/vCal.php
suitecrm_version.php
tests/unit/phpunit/modules/Employees/EmployeeTest.php
tests/unit/phpunit/modules/Users/UserTest.php
Commit message: SuiteCRM 7.12.5 Release


Vulnerable code:
# SuiteCRM 7.12.4
// created: 2022-02-10 17:00:00
  './Api/V8/JsonApi/Repository/Filter.php' => 'cc024de98508d60c0d091a58a49fa879',
  './README.md' => '3851c72e794004a8dea5141835e9f67f',
  './include/SugarObjects/templates/basic/metadata/metafiles.php' => '5dc7c77d1e65d8f0e5dafa6f5d4b3969',
  './include/SugarObjects/templates/company/metadata/metafiles.php' => '5dc7c77d1e65d8f0e5dafa6f5d4b3969',
  './include/SugarObjects/templates/file/metadata/metafiles.php' => '30b981844f4f61f7120cc6fd71e6df2b',
  './include/SugarObjects/templates/issue/metadata/metafiles.php' => '5dc7c77d1e65d8f0e5dafa6f5d4b3969',
  './include/SugarObjects/templates/person/metadata/metafiles.php' => '5dc7c77d1e65d8f0e5dafa6f5d4b3969',
  './include/SugarObjects/templates/sale/metadata/metafiles.php' => 'c66eca250effcffa927a528e55be1420',
  './include/language/en_us.lang.php' => 'b3e2e4ddf37fa8614a55749c8f22aea6',
  './lib/Search/UI/SearchResultsController.php' => '5c3be29f03a58a39dea00393c1dfc01e',
  './modules/AOR_Scheduled_Reports/AOR_Scheduled_Reports.php' => '1d67cfee23f2da1d546578bc27545a74',
  './modules/Calendar/CalendarActivity.php' => '0cead97402da329cb1f4748058f3dd0a',
  './modules/Emails/include/ComposeView/ComposeView.tpl' => '1ec29fbb9803c24e5ed8a12155668e58',
  './modules/Emails/include/ComposeView/EmailsComposeView.js' => '65624a5e5985e5f9deee1e4725533462',
  './modules/Emails/vardefs.php' => '3b7cf8c8a768bd5c4d1bcdb5bd05e7d2',
  './modules/Employees/Employee.php' => 'c837db1f7627ee68383a041c51bb8b9c',
  './modules/ModuleBuilder/Module/IconRepository.php' => '20cd01f8300b411bacffb53361ed6f08',
  './modules/ModuleBuilder/language/en_us.lang.php' => '9171bfd805fcedff0bbc38266d6395b5',
  './modules/ProspectLists/Duplicate.php' => '51ef701820dbf25644722d961ed1121f',
  './modules/Users/User.php' => 'e0e65bf73d91fcc730b923eb95fe37c2',
  './modules/vCals/vCal.php' => '11257a95accc06fa64afc8d60425d663',
  './suitecrm_version.php' => '14057aacc3f8a801fddbfd87976aec77',
  './themes/SuiteP/css/Dawn/style.css' => '4b00f6c1bbea501b7b2d100b7b11e556',
  './themes/SuiteP/css/Day/style.css' => 'aa909eb7a2ec2772a66ca0707fe8d419',
  './themes/SuiteP/css/Dusk/style.css' => 'c948f679584e96d3ce39050d36b82e8b',
  './themes/SuiteP/css/Night/style.css' => 'b08ab4c6a46bca69b8b5affc3c108f24',
  './themes/SuiteP/css/Noon/style.css' => '5f0a4b744c3057d5efc137791411aa2a',
  './themes/SuiteP/css/suitep-base/listview.scss' => '083c62124b7f3c7dbf32a3f10e06cf35',
  './themes/SuiteP/include/Dashlets/DashletHeader.tpl' => '83586d72dbd43540f4d71b6b5db354f5',
  './themes/SuiteP/include/DetailView/DetailView.tpl' => '4829a5f5b6ac00c01c321948b4481a95',
  './themes/SuiteP/include/EditView/EditView.tpl' => '5e279ffcc56b22f3c2d6032247fa288e',
);
        if (isset($_POST['email_recipients']) && is_array($_POST['email_recipients'])) {
            $this->email_recipients = base64_encode(serialize($_POST['email_recipients']));
        }
        
                require_once 'modules/SecurityGroups/SecurityGroup.php';
                    $focusBean->show_as_busy = $show_as_busy;
        'SurveyQuestionOptions' => self::DEFAULT_ICON,
        'SurveyQuestionResponses' =>  self::DEFAULT_ICON,
        'SurveyQuestions' => self::DEFAULT_ICON,
        return isset(static::$iconNames[$module])
            ? static::$iconNames[$module]
            : strtolower(str_replace('_', '-', $module));
    
    $query  = "select * from prospect_lists_prospects where prospect_list_id = '".$_POST['record']."'";
            global $DO_USER_TIME_OFFSET, $timedate, $current_user;
                    $startTime = $timedate->fromUser($act->sugar_bean->date_start, $user_bean);
                    $endTime = $timedate->fromUser($act->sugar_bean->date_finish, $user_bean);
$suitecrm_version = '7.12.4';
$suitecrm_timestamp = '2022-02-10 12:00:00';
        $expected = "SELECT id, user_name, first_name, last_name, description, date_entered, date_modified, modified_user_id, created_by, title, department, is_admin, phone_home, phone_mobile, phone_work, phone_other, phone_fax, address_street, address_city, address_state, address_postalcode, address_country, reports_to_id, portal_only, status, receive_notifications, employee_status, messenger_id, messenger_type, is_group FROM users  WHERE  users.deleted = 0 AND users.is_admin=0 ORDER BY users.user_name";
        $expected = "SELECT id, user_name, first_name, last_name, description, date_entered, date_modified, modified_user_id, created_by, title, department, is_admin, phone_home, phone_mobile, phone_work, phone_other, phone_fax, address_street, address_city, address_state, address_postalcode, address_country, reports_to_id, portal_only, status, receive_notifications, employee_status, messenger_id, messenger_type, is_group FROM users  WHERE user_name=\"\" AND  users.deleted = 0 AND users.is_admin=0 ORDER BY id";

Fixed code:
# SuiteCRM 7.12.5
// created: 2022-03-01 17:00:00
  './Api/V8/JsonApi/Repository/Filter.php' => '21279c505e18aacd9f6aea51cc62a3bc',
  './README.md' => 'b9189e1dc12fb6ee741b6057b9e70147',
  './include/SugarObjects/templates/basic/metadata/metafiles.php' => '80e1c107fcf93fe0a78cf5dd7146b3f5',
  './include/SugarObjects/templates/basic/metadata/subpaneldefs.php' => 'decf6423acb6b44f331f9f8b54c19ff0',
  './include/SugarObjects/templates/company/metadata/metafiles.php' => '80e1c107fcf93fe0a78cf5dd7146b3f5',
  './include/SugarObjects/templates/company/metadata/subpaneldefs.php' => '50acf29d6c53bd5a58dac8b21971d94b',
  './include/SugarObjects/templates/file/metadata/metafiles.php' => 'c44b4a1bae97f1d29608af2aaf3e931d',
  './include/SugarObjects/templates/file/metadata/subpaneldefs.php' => 'decf6423acb6b44f331f9f8b54c19ff0',
  './include/SugarObjects/templates/issue/metadata/metafiles.php' => '80e1c107fcf93fe0a78cf5dd7146b3f5',
  './include/SugarObjects/templates/issue/metadata/subpaneldefs.php' => 'decf6423acb6b44f331f9f8b54c19ff0',
  './include/SugarObjects/templates/person/metadata/metafiles.php' => '80e1c107fcf93fe0a78cf5dd7146b3f5',
  './include/SugarObjects/templates/person/metadata/subpaneldefs.php' => 'decf6423acb6b44f331f9f8b54c19ff0',
  './include/SugarObjects/templates/sale/metadata/metafiles.php' => 'c44b4a1bae97f1d29608af2aaf3e931d',
  './include/SugarObjects/templates/sale/metadata/subpaneldefs.php' => 'decf6423acb6b44f331f9f8b54c19ff0',
  './include/language/en_us.lang.php' => '9b8bee2691bda327f6b973fa789de805',
  './lib/Search/UI/SearchResultsController.php' => '21c2ecf52498c7e3109464e4fddd32a7',
  './modules/AOR_Scheduled_Reports/AOR_Scheduled_Reports.php' => '37085ac71ea851fc00d66dbf569885f7',
  './modules/Calendar/CalendarActivity.php' => '9e55048969b6abcb58443296057f8fce',
  './modules/Emails/include/ComposeView/ComposeView.tpl' => 'aee5736e992aecc485afbb5973d9e535',
  './modules/Emails/include/ComposeView/EmailsComposeView.js' => '8ed14ba39eff3d7ec030538431ad3999',
  './modules/Emails/vardefs.php' => 'dae3869d4728b0bc63a3afe2532ee0cb',
  './modules/Employees/Employee.php' => '2a70486e775ccc8e4c36176855d5c1e7',
  './modules/ModuleBuilder/Module/IconRepository.php' => '5fbd04824f79784669ba38326a18096f',
  './modules/ModuleBuilder/language/en_us.lang.php' => 'b73ec441c51179efa58d1a65e2160252',
  './modules/ProspectLists/Duplicate.php' => 'f73bdc77dd9e63b24e69897105947500',
  './modules/Users/User.php' => 'a75ad79197349bc156f9365ef3830b9c',
  './modules/vCals/vCal.php' => 'e20c0d7ec2b900ce37c8d621db8835ad',
  './suitecrm_version.php' => '44698d65949ec2aaa3489747310fb8be',
  './themes/SuiteP/css/Dawn/style.css' => 'fa371bfc0663c488d723ce828d1e7171',
  './themes/SuiteP/css/Day/style.css' => '6d2e8777837f4a3c9c673b403b95eef2',
  './themes/SuiteP/css/Dusk/style.css' => '5bfde54ca4e8a9315b384a4ae0cdc7f7',
  './themes/SuiteP/css/Night/style.css' => 'ee55328617a2cfa5a1a7583db1afd6b6',
  './themes/SuiteP/css/Noon/style.css' => '504a6fcca636cdbad859ac6a8d1b47c8',
  './themes/SuiteP/css/suitep-base/listview.scss' => '46898f8372bdd796e5ddeed167bd0c30',
  './themes/SuiteP/include/Dashlets/DashletHeader.tpl' => '09e4767d1ff01a830c0de2706e833a11',
  './themes/SuiteP/include/DetailView/DetailView.tpl' => 'ff62ab3dc8d5b6e91a4c1041c043592e',
  './themes/SuiteP/include/EditView/EditView.tpl' => '7ad41f35fa8b0aa7dbaae48189c38edb',
);
        $this->parseRecipients();

    /**
     * Parse and set recipients
     * @return void
     */
    protected function parseRecipients(): void
    {
        $recipients = $_POST['email_recipients'] ?? null;
        unset($_POST['email_recipients'], $_REQUEST['email_recipients'], $_GET['email_recipients']);
        $this->email_recipients = null;

        if (is_array($recipients)) {
            $types = $recipients['email_target_type'] ?? [];
            $emailInfo = $recipients['email'] ?? [];
            $recipients = [
                'email_target_type' => $types,
                'email' => $emailInfo,
            ];

            $this->email_recipients = base64_encode(serialize($recipients));
        }
    }

                //require_once 'modules/SecurityGroups/SecurityGroup.php';
                    /* TODO update currently unused functionality, disabled as expensive
                    $focusBean->show_as_busy = $show_as_busy;*/
        global $current_user;
        if (!is_admin($current_user)) {
            throw new RuntimeException('Not authorized');
        }

        AOR_Scheduled_Reports::class => 'aor-reports',
        'SurveyQuestionResponses' =>  'survey-responses',
        return static::$iconNames[$module] ?? strtolower(str_replace('_', '-', $module));

    $query  = "select * from prospect_lists_prospects where prospect_list_id = '". $focus->db->quote($_POST['record']) ."'";
        if (!$this->hasSaveAccess()) {
           throw new RuntimeException('Not authorized');
        }

        global $current_user;
        if (!is_admin($current_user)) {
            throw new RuntimeException('Not authorized');
        }


    /**
     * Check if current user can save the current user record
     * @return bool
     */
    protected function hasSaveAccess(): bool
    {
        global $current_user;

        if (empty($this->id)) {
            return true;
        }

        if (empty($current_user->id)) {
            return true;
        }

        $sameUser = $current_user->id === $this->id;

        return $sameUser || is_admin($current_user);
    }
            global $DO_USER_TIME_OFFSET, $timedate;
                    $act->start_time = $timedate->fromUser($act->sugar_bean->date_start, $user_bean);
                    $act->end_time = $timedate->fromUser($act->sugar_bean->date_finish, $user_bean);
$suitecrm_version = '7.12.5';
$suitecrm_timestamp = '2022-03-01 12:00:00';
        global $current_user;
        $current_user->is_admin = '1';

        $current_user->is_admin = '0';
        $this->expectException(RuntimeException::class);
        $employee->create_export_query('', '');

        global $current_user;
        $current_user->is_admin = '1';
        $expected = "SELECT id, user_name, first_name, last_name, description, date_entered, date_modified, modified_user_id, created_by, title, department, is_admin, phone_home, phone_mobile, phone_work, phone_other, phone_fax, address_street, address_city, address_state, address_postalcode, address_country, reports_to_id, portal_only, status, receive_notifications, employee_status, messenger_id, messenger_type, is_group FROM users  WHERE  users.deleted = 0 ORDER BY users.user_name";
        $expected = "SELECT id, user_name, first_name, last_name, description, date_entered, date_modified, modified_user_id, created_by, title, department, is_admin, phone_home, phone_mobile, phone_work, phone_other, phone_fax, address_street, address_city, address_state, address_postalcode, address_country, reports_to_id, portal_only, status, receive_notifications, employee_status, messenger_id, messenger_type, is_group FROM users  WHERE user_name=\"\" AND  users.deleted = 0 ORDER BY id";

        $current_user->is_admin = '0';
        $this->expectException(RuntimeException::class);
        $user->create_export_query('', '');