CVE-2015-10036 (PHP, published 2023-01-11T07:15Z)
Description: value: A vulnerability was found in kylebebak dronfelipe. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named 87405b74fe651892d79d0dff62ed17a7eaef6a60. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217951.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/kylebebak/dronfelipe
Files changed:
location_history/controllers/__build_query.php
location_history/controllers/__parse_query.php
location_history/controllers/global.php
location_history/controllers/graph.php
location_history/controllers/main.php
location_history/controllers/trips.php
location_history/controllers/visits.php
location_history/css/style.css
Commit message: this commit is important, it has prevented all sql injection attacks in location_history by either using prepared statements or using mysqli::real_escape_string


Vulnerable code:

	$query .= " AND start_date >= STR_TO_DATE('" . htmlspecialchars($dateFilter[0]) . "', '%m/%d/%Y')";
	$query .= " AND start_date <= STR_TO_DATE('" . htmlspecialchars($dateFilter[1]) . "', '%m/%d/%Y')";
	$query .= " AND DAYOFWEEK(start_date) NOT IN (" . htmlspecialchars($dayFilter) . ")";
	$limit = $_POST['limit'];
	$dayFilter = implode(',', $_POST['dayFilter']);
// filter out certain days of the week
$visits = $db->rawQuery($query, null, false);
$trips = $db->rawQuery($query, null, false);
$location_id = $_POST['location_id'];


	WHERE location_id = " . htmlspecialchars($location_id);
$results = $db->rawQuery($query, null, false);
	$query .= " LIMIT " . htmlspecialchars($limit);
echo json_encode($db->rawQuery($query, null, false));
$location_id = htmlspecialchars($_POST['location_id']);
$start_aggregate = $db->rawQuery($query, null, false);
$start_all = $db->rawQuery($query, null, false);
$end_aggregate = $db->rawQuery($query, null, false);
$end_all = $db->rawQuery($query, null, false);
$start_end_all = $db->rawQuery($query, null, false);
$location_id = $_POST['location_id'];


	WHERE location_id = " . htmlspecialchars($location_id);
$results = $db->rawQuery($query, null, false);



Fixed code:
	$query .= " AND start_date >= STR_TO_DATE('" . $db->mysqli()->real_escape_string($dateFilter[0]) . "', '%m/%d/%Y')";
	$query .= " AND start_date <= STR_TO_DATE('" . $db->mysqli()->real_escape_string($dateFilter[1]) . "', '%m/%d/%Y')";
	$query .= " AND DAYOFWEEK(start_date) NOT IN (" . $dayFilter . ")";
	$limit = $db->mysqli()->real_escape_string($_POST['limit']);
	$dayFilter = $db->mysqli()->real_escape_string(implode(',', $_POST['dayFilter']));
// filter out certain days of the week. the elements of this array are escaped in __build_query.php
$visits = $db->rawQuery($query, null);
$trips = $db->rawQuery($query, null);
	WHERE location_id = ?";
$results = $db->rawQuery($query, Array($_POST['location_id']));
	$query .= " LIMIT " . $limit;
echo json_encode($db->rawQuery($query, null));
$location_id = $db->mysqli()->real_escape_string($_POST['location_id']);
$start_aggregate = $db->rawQuery($query, null);
$start_all = $db->rawQuery($query, null);
$end_aggregate = $db->rawQuery($query, null);
$end_all = $db->rawQuery($query, null);
$start_end_all = $db->rawQuery($query, null);
	WHERE location_id = ?";
$results = $db->rawQuery($query, Array($_POST['location_id']));
label.checkbox {
	color: black !important;
}