CVE-2017-6087 (PHP, published 2017-03-24T14:59Z)
Description: value: EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4) module parameter to module/index.php.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/EyesOfNetworkCommunity/eonweb
Files changed:
include/arrays.php
include/function.php
module/admin_bp/php/auto_completion.php
module/admin_bp/php/function_bp.php
module/admin_user/search.php
module/index.php
module/monitoring_ged/ajax.php
module/monitoring_ged/ged_actions.php
module/monitoring_ged/ged_functions.php
Commit message: Fix vulnerabilities


Vulnerable code:
function sqlrequest($database,$sql,$id=false){
	$result=mysqli_query($connexion, "$sql");

  // Mot tapé par l'utilisateur
  $q = $_GET['query'];
	$table_name = $_GET['table_name'];
    try {
        $bdd = new PDO('mysql:host=localhost;dbname=lilac', 'root', 'root66');
    } catch(Exception $e) {
		 echo "Connection failed: " . $e->getMessage();
        exit('Impossible de se connecter à la base de données.');
    }
    // Requête SQL
    $requete = "SELECT name FROM " . $table_name .  " WHERE name LIKE '". $q ."%' LIMIT 0, 10";
	foreach  ($bdd->query($requete) as $row) {
		$suggestions['suggestions'][] = $row['name'];
	}
    echo json_encode($suggestions);
	$bdd = new PDO('mysql:host=localhost;dbname=nagiosbp', 'root', 'root66');
    $sql = "delete from bp where name = '" . $bp . "'";
    $bdd->exec($sql);
	$sql = "delete from bp_services where bp_name = '" . $bp . "'";
    $bdd->exec($sql);
	$sql = "delete from bp_links where bp_name = '" . $bp . "'";
	$bdd->exec($sql);
	$sql = "delete from bp_links where bp_link = '" . $bp . "'";
	$bdd->exec($sql);
	$sql = "select name from bp where is_define = 1 and name!='".$bp."' and priority = '" . $display . "'";
	$req = $bdd->query($sql);
	$sql = "select service,host from bp_services where bp_name = '" . $bp . "'";
	$req = $bdd->query($sql);
	$sql = "delete from bp_services where bp_name = '" . $bp . "'";
	$bdd->exec($sql);
		$sql = "update bp set is_define = 1 where name = '" . $bp . "'";
		$bdd->exec($sql);

		$sql = "update bp set is_define = 0 where name = '" . $bp . "'";
        $bdd->exec($sql);
			$sql = "insert into bp_services (bp_name,host,service) values('" . trim($bp) . "','" . $host . "','" . $service . "')";
			$bdd->exec($sql);
    $sql = "delete from bp_links where bp_name = '" . $bp . "'";
    $bdd->exec($sql);
	$sql = "update bp set is_define = 0 where name = '" . $bp . "'";
	$bdd->exec($sql);	
        $sql = "update bp set is_define = 1 where name = '" . $bp . "'";
        $bdd->exec($sql);
			$sql = "insert into bp_links (bp_name,bp_link) values('" . $bp . "','" . $bp_link . "')";
			$bdd->exec($sql);
	$sql = "select count(*) from bp where name = '" . $uniq_name . "';";
	$req = $bdd->query($sql);
	$sql = "select count(*) from bp where name = '" . $uniq_name . "';";
	$req = $bdd->query($sql);
		$sql = "insert into bp (name,description,priority,type,command,url,min_value) values('" . $uniq_name ."','" . $process_name ."','" . $display . "','" . $type . "','" . $command . "','" . $url . "','" . $min_value . "')";
		$bdd->exec($sql);
			$sql = "update bp set name = '" . $uniq_name . "',description = '" . $process_name . "',priority = '" . $display . "',type = '" . $type . "',command = '" . $command . "',url = '" . $url . "',min_value = '" . $min_value . "' where name = '" . $uniq_name_orig . "'";
			$bdd->exec($sql);
			$sql = "update bp_links set bp_name = '" . $uniq_name . "' where bp_name = '" . $uniq_name_orig . "'";
			$bdd->exec($sql);		
			$sql = "update bp_links set bp_link = '" . $uniq_name . "' where bp_link = '" . $uniq_name_orig . "'";
			$bdd->exec($sql);
			$sql = "update bp_services set bp_name = '" . $uniq_name . "' where bp_name = '" . $uniq_name_orig . "'";					
			$bdd->exec($sql);		
		$sql = "update bp set name = '" . $uniq_name . "',description = '" . $process_name . "',priority = '" . $display . "',type = '" . $type . "',command = '" . $command . "',url = '" . $url . "',min_value = '" . $min_value . "' where name = '" . $uniq_name . "'";
		$bdd->exec($sql);	
	$sql = "SELECT bp_link FROM bp_links where bp_name='".$bp_informations['name']."'";
	$req = $bdd->query($sql);
			$sql = "SELECT * FROM bp where is_define ='1' and name='".$bp_link["bp_link"]."'";
			$req = $bdd->query($sql);
	$sql = "select host,service from bp_services where bp_name = '" . $bp_informations['name'] . "'";
	$req = $bdd->query($sql);
	$sql = "select bp_link from bp_links where bp_name = '" .$bp_informations['name'] . "'";
	$req = $bdd->query($sql);
	$sql = "select * from bp where name = '" . $bp_name . "'";
	$req = $bdd->query($sql);
	$result=sqlrequest($database_eonweb,"select * from ldap_users_extended where (user LIKE '%".$_GET['term']."%') OR (login LIKE '%".$_GET['term']."%') order by user");
	$module=exec("rpm -q ".$_GET["module"]." |grep '.eon' |wc -l");
	# Redirect to module page if rpm installed
	if($module!=0) { header('Location: '.$_GET["link"].''); }
						$ged_where = "WHERE pkt_type_id!='0'";
						$ged_where = "WHERE pkt_type_id='".$_GET["type"]."'";
					$gedsql_result1=sqlrequest($database_ged,"SELECT pkt_type_id,pkt_type_name FROM pkt_type $ged_where AND pkt_type_id<'100';");
					
									$sql .= " AND o_sec <= ". $actual_time ." AND o_sec > ". $five_minutes;
									$sql .= " AND o_sec <= ". $five_minutes ." AND o_sec > ". $fifteen_minutes;
									$sql .= " AND o_sec <= ". $fifteen_minutes ." AND o_sec > ". $thirty_minutes;
									$sql .= " AND o_sec <= ". $thirty_minutes ." AND o_sec > ". $one_hour;
									$sql .= " AND o_sec <= ". $one_hour;
							$sql .= " AND a_sec - o_sec >= $ack_time";
										$sql .= " AND ($key LIKE '$like'";
										$sql .= " OR $key LIKE '$like'";
						$request = sqlrequest($database_ged, $sql);
		$where_clause .= " AND $filter LIKE '$like'";
		$where_clause .= " AND o_sec > $start AND o_sec < $end";
	if($ok != "")		{ $states_list .= "0,"; }
	if($warning != "")	{ $states_list .= "1,"; }
	if($critical != "")	{ $states_list .= "2,"; }
	if($unknown != "")	{ $states_list .= "3,"; }
	$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
	$result = sqlrequest($database_ged, $sql);
	$sql = "SELECT comments FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
	$result = sqlrequest($database_ged, $sql);
	$event["comments"] = str_replace("\'", "'", $event["comments"]);
	$event["comments"] = str_replace("\#", "#'", $event["comments"]);

	// format comment string to avoid errors
	$comments = str_replace("'", "\'", $comments);
	$comments = str_replace("#", "\#", $comments);

	$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments='$comments' WHERE id = $id";
	$result = sqlrequest($database_ged, $sql);
		// format comment string to avoid errors
		$comments = str_replace("'", "\'", $comments);
		$comments = str_replace("#", "\#", $comments);

		$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments='$comments' WHERE id = $id";
		$result = sqlrequest($database_ged, $sql);
		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
		$result = sqlrequest($database_ged, $sql);

		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = $id";
		$result = sqlrequest($database_ged, $sql);



	
	while($ged_type = mysqli_fetch_assoc($gedsql_result1)){
		$sql = "SELECT DISTINCT $filter FROM ".$ged_type["pkt_type_name"]."_queue_".$queue;

		$results = sqlrequest($database_ged, $sql);
		while($result = mysqli_fetch_array($results)){
			if( !in_array($result[$filter], $datas) && $result[$filter] != "" ){
				array_push($datas, $result[$filter]);

Fixed code:
$array_modules = array ("glpi","ocsinventory-reports");
	
$array_ged_queues = array("active","sync","history");
		
function sqlrequest($database,$sql,$id=false,$prepare=false){
	
	if(is_array($prepare)) {
		$stmt = mysqli_prepare($connexion,$sql);
		
		if(isset($prepare[0]) && isset($prepare[1])) {
			$ref = new ReflectionClass('mysqli_stmt');
			$method = $ref->getMethod("bind_param");
			$method->invokeArgs($stmt,$prepare);
		}
		
		mysqli_stmt_execute($stmt);
		$result = mysqli_stmt_get_result($stmt);
	} else {
		$result=mysqli_query($connexion, "$sql");
	}
		
include("../../../include/config.php");
// Mot tapé par l'utilisateur
$q = $_GET['query'];
$table_name = $_GET['table_name'];

try {
	$bdd = new PDO('mysql:host=localhost;dbname='.$database_lilac, $database_username, $database_password);
} catch(Exception $e) {
	 echo "Connection failed: " . $e->getMessage();
	exit('Impossible de se connecter à la base de données.');
}

// Requête SQL
$requete = "SELECT name FROM " . $table_name .  " WHERE name LIKE '". $q ."%' LIMIT 0, 10";

foreach  ($bdd->query($requete) as $row) {
	$suggestions['suggestions'][] = $row['name'];
}
echo json_encode($suggestions);
include("../../../include/config.php");

	$bdd = new PDO('mysql:host=localhost;dbname='.$database_nagios, $database_username, $database_password);
	$sql = "delete from bp where name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
	$sql = "delete from bp_services where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
	$sql = "delete from bp_links where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
	$sql = "delete from bp_links where bp_link = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
	$sql = "select name from bp where is_define = 1 and name!=? and priority = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp,$display));
	$sql = "delete from bp_services where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
		$sql = "update bp set is_define = 1 where name = ?";
		$req = $bdd->prepare($sql);
		$req->execute(array($bp));
		$sql = "update bp set is_define = 0 where name = ?";
		$req = $bdd->prepare($sql);
		$req->execute(array($bp));
			$sql = "insert into bp_services (bp_name,host,service) values(?,?,?)";
			$req = $bdd->prepare($sql);
			$req->execute(array(trim($bp),$host,$service));
	$sql = "delete from bp_links where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
	$sql = "update bp set is_define = 0 where name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp));
		$sql = "update bp set is_define = 1 where name = ?";
		$req = $bdd->prepare($sql);
		$req->execute(array($bp));
			$sql = "insert into bp_links (bp_name,bp_link) values(?,?)";
			$req = $bdd->prepare($sql);
			$req->execute(array($bp,$bp_link));
	$sql = "select count(*) from bp where name = ?;";
	$req = $bdd->prepare($sql);
	$req->execute(array($uniq_name));
	$sql = "select count(*) from bp where name = ?;";
	$req = $bdd->prepare($sql);
	$req->execute(array($uniq_name));
		$sql = "insert into bp (name,description,priority,type,command,url,min_value) values(?,?,?,?,?,?,?)";
		$req = $bdd->prepare($sql);
		$req->execute(array($uniq_name,$process_name,$display,$type,$command,$url,$min_value));
			$sql = "update bp set name = ?,description = ?,priority = ?,type = ?,command = ?,url = ?,min_value = ? where name = ?";
			$req = $bdd->prepare($sql);
			$req->execute(array($uniq_name,$process_name,$display,$type,$command,$url,$min_value,$uniq_name_orig));
			$sql = "update bp_links set bp_name = ? where bp_name = ?";
			$req = $bdd->prepare($sql);
			$req->execute(array($uniq_name,$uniq_name_orig));	
			$sql = "update bp_links set bp_link = ? where bp_link = ?";
			$req = $bdd->prepare($sql);
			$req->execute(array($uniq_name,$uniq_name_orig));
			$sql = "update bp_services set bp_name = ? where bp_name = ?";					
			$req = $bdd->prepare($sql);
			$req->execute(array($uniq_name,$uniq_name_orig));	
		$sql = "update bp set name = ?,description = ?,priority = ?,type = ?,command = ?,url = ?,min_value = ? where name = ?";
		$req = $bdd->prepare($sql);
		$req->execute(array($uniq_name,$process_name,$display,$type,$command,$url,$min_value,$uniq_name));
	$sql = "SELECT bp_link FROM bp_links where bp_name=?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp_informations['name']));
			$sql = "SELECT * FROM bp where is_define ='1' and name=?";
			$req = $bdd->prepare($sql);
			$req->execute(array($bp_link["bp_link"]));
	$sql = "select host,service from bp_services where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp_informations['name']));
	$sql = "select bp_link from bp_links where bp_name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp_informations['name']));
	$sql = "select * from bp where name = ?";
	$req = $bdd->prepare($sql);
	$req->execute(array($bp_name));
	$sql="select * from ldap_users_extended where (user LIKE ?) OR (login LIKE ?) order by user";
	$result=sqlrequest($database_eonweb,$sql,false,array("ss","%".$_GET['term']."%","%".$_GET['term']."%"));
	include("../include/config.php");
	include("../include/arrays.php");
	if(in_array($_GET["module"],$array_modules)) {
		$module=exec("rpm -q ".$_GET["module"]." |grep '.eon' |wc -l");
		# Redirect to module page if rpm installed
		if($module!=0) { header('Location: '.$_GET["link"].''); }
	}
if(!isset($queue)) { $queue="active"; } 
elseif(!in_array($queue,$array_ged_queues)) { $queue="active"; }
						$sql = "SELECT pkt_type_id,pkt_type_name FROM pkt_type WHERE pkt_type_id!='0' AND pkt_type_id<'100';";
						$gedsql_result1=sqlrequest($database_ged,$sql);
						$sql = "SELECT pkt_type_id,pkt_type_name FROM pkt_type WHERE pkt_type_id=? AND pkt_type_id<'100';";
						$prepare=array("i",(int)$_GET["type"]);
						$gedsql_result1=sqlrequest($database_ged,$sql,false,$prepare);
										
						$mysqli_prepare=array("");
									$sql .= " AND o_sec <= ? AND o_sec > ?";
									$mysqli_prepare[0].="ii";
									$mysqli_prepare[]=(int)$actual_time;
									$mysqli_prepare[]=(int)$five_minutes;
									$sql .= " AND o_sec <= ? AND o_sec > ?";
									$mysqli_prepare[0].="ii";
									$mysqli_prepare[]=(int)$five_minutes;
									$mysqli_prepare[]=(int)$fifteen_minutes;
									$sql .= " AND o_sec <= ? AND o_sec > ?";
									$mysqli_prepare[0].="ii";
									$mysqli_prepare[]=(int)$fifteen_minutes;
									$mysqli_prepare[]=(int)$thirty_minutes;
									$sql .= " AND o_sec <= ? AND o_sec > ?";
									$mysqli_prepare[0].="ii";
									$mysqli_prepare[]=(int)$thirty_minutes;
									$mysqli_prepare[]=(int)$one_hour;
									$sql .= " AND o_sec <= ?";
									$mysqli_prepare[0].="i";
									$mysqli_prepare[]=(int)$one_hour;
							$sql .= " AND a_sec - o_sec >= ?";
							$mysqli_prepare=array("i",(int)$ack_time);
										$sql .= " AND ($key LIKE ?";
										$mysqli_prepare[0].="s";
										$mysqli_prepare[]=(string)$like;
										$sql .= " OR $key LIKE ?";
										$mysqli_prepare[0].="s";
										$mysqli_prepare[]=(string)$like;
						$request = sqlrequest($database_ged, $sql, false, $mysqli_prepare);
if(!isset($queue)) { $queue="active"; } 
elseif(!in_array($queue,$array_ged_queues)) { $queue="active"; }
	global $array_ged_queues;

	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	global $array_ged_queues; 
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }

	
	global $mysqli_prepare;
	
		$where_clause .= " AND $filter LIKE ?";
		$mysqli_prepare[0].="s";
		$mysqli_prepare[]=(string)$like;
		$where_clause .= " AND o_sec > ? AND o_sec < ?";
		$mysqli_prepare[0].="ii";
		$mysqli_prepare[]=(int)$start;
		$mysqli_prepare[]=(int)$end;
	if($ok != "")		{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=0; }
	if($warning != "")	{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=1; }
	if($critical != "")	{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=2; }
	if($unknown != "")	{ $states_list .= "?,"; $mysqli_prepare[0].="i"; $mysqli_prepare[]=3; }
	global $array_ged_queues; 
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }

	$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
	$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
	global $array_ged_queues; 
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }

	$sql = "SELECT comments FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
	$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
	global $array_ged_queues;
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	
	$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments=? WHERE id = ?";
	$result = sqlrequest($database_ged, $sql, false, array("ss",(string)$comments,(string)$id));
	global $array_ged_queues;
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	
		$sql = "UPDATE ".$ged_type."_queue_".$queue." SET comments=? WHERE id = ?";
		$result = sqlrequest($database_ged, $sql, false, array("ss",(string)$comments,(string)$id));
	global $array_ged_queues;
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	
		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
		$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
		$ged_command=escapeshellcmd($ged_command);
		
	global $array_ged_queues;
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	
		$sql = "SELECT * FROM ".$ged_type."_queue_".$queue." WHERE id = ?";
		$result = sqlrequest($database_ged, $sql, false, array("s",(string)$id));
		$ged_command=escapeshellcmd($ged_command);
		
	global $array_ged_queues;
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	
			$ged_command=escapeshellcmd($ged_command);
					
		$ged_command=escapeshellcmd($ged_command);
		
	global $array_ged_packets;
	global $array_ged_queues;
	
	if(!in_array($queue,$array_ged_queues)) { $queue=$array_ged_queues[0]; }
	if(isset($array_ged_packets[$filter])) {
		while($ged_type = mysqli_fetch_assoc($gedsql_result1)){
			$sql = "SELECT DISTINCT $filter FROM ".$ged_type["pkt_type_name"]."_queue_".$queue;

			$results = sqlrequest($database_ged, $sql);
			while($result = mysqli_fetch_array($results)){
				if( !in_array($result[$filter], $datas) && $result[$filter] != "" ){
					array_push($datas, $result[$filter]);
				}