CVE-2015-10064 (PHP, published 2023-01-17T19:15Z)
Description: value: A vulnerability was found in VictorFerraresi pokemon-database-php. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named dd0e1e6cdf648d6a3deff441f515bcb1d7573d68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218455.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/VictorFerraresi/pokemon-database-php
Files changed:
addStrike.php
editStrike.php
golpes.php
validateRegister.php
Commit message: Removida a vulnerabilidade do site à SQL Injection.

Vulnerable code:
function tryAddStrike($name, $damage, $type){     
    $result = mysql_query("SELECT * FROM `pokemon`.`golpes` WHERE name = '$name' LIMIT 1");    
        $result = mysql_query("INSERT INTO `pokemon`.`golpes` (`name`, `damage`, `type`) VALUES ('$name', '$damage', '$type')");            

        $result = mysql_query("UPDATE `pokemon`.`golpes` SET `name` = '$name', `damage` = '$damage', `type` = '$type' WHERE `id` = '$id'");            
    require 'mysqlcon.php';     
    $sth = mysql_query("SELECT `name` FROM `pokemon`.`golpes` where name like '" . $a."%'");
function tryRegister($user, $email, $pass){     
    $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE user = '$user' LIMIT 1");    
        $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE email = '$email' LIMIT 1");
            $result = mysql_query("INSERT INTO `pokemon`.`usuarios` (`user`, `email`, `password`) VALUES ('$user', '$email', '$pass')");            

Fixed code:
function tryAddStrike($name, $damage, $type){   
    $ename = mysql_real_escape_string($name);
    $edamage = mysql_real_escape_string($damage);
    $result = mysql_query("SELECT * FROM `pokemon`.`golpes` WHERE name = '$ename' LIMIT 1");    
        $result = mysql_query("INSERT INTO `pokemon`.`golpes` (`name`, `damage`, `type`) VALUES ('$ename', '$edamage', '$type')");            
    $ename = mysql_real_escape_string($name);
    $edamage = mysql_real_escape_string($damage);
        $result = mysql_query("UPDATE `pokemon`.`golpes` SET `name` = '$ename', `damage` = '$edamage', `type` = '$type' WHERE `id` = '$id'");            
    require 'mysqlcon.php';       
    $ea = mysql_real_escape_string($a);
    $sth = mysql_query("SELECT `name` FROM `pokemon`.`golpes` where name like '" . $ea."%'");
function tryRegister($user, $email, $pass){   
    $euser = mysql_real_escape_string($user);
    $eemail = mysql_real_escape_string($email);
    $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE user = '$euser' LIMIT 1");    
        $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE email = '$eemail' LIMIT 1");
            $result = mysql_query("INSERT INTO `pokemon`.`usuarios` (`user`, `email`, `password`) VALUES ('$euser', '$eemail', '$pass')");