CVE-2017-14242 (PHP, published 2017-09-11T09:29Z)
Description: value: SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/core/lib/functions.lib.php
htdocs/don/card.php
htdocs/don/document.php
htdocs/don/info.php
htdocs/don/list.php
htdocs/don/note.php
htdocs/install/mysql/migration/5.0.0-6.0.0.sql
Commit message: FIX SQL injection

Vulnerable code:
	print '<td class="border" valign="top">' . $langs->trans('NotePublic') . '</td>';
		print '<td class="border" valign="top">' . $langs->trans('NotePrivate') . '</td>';
	dol_fiche_head($head, $hselected, $langs->trans("Donation"), 0, 'generic');
	dol_fiche_head($head, 'documents',  $langs->trans("Donation"), 0, 'generic');
	
	
	
	
	
    
    
    
dol_fiche_head($head, 'info', $langs->trans("Donation"), 0, 'generic');
      
$statut=isset($_GET["statut"])?$_GET["statut"]:"-1";
if ($statut >= 0)
	$sql .= " AND d.fk_statut = ".$statut;
    $sql.= ' AND d.rowid LIKE \'%'.$db->escape(trim($search_ref)) . '%\'';
if ($search_amount) $sql.= natural_search(array('d.amount'), price2num(trim($search_amount)), 1);
	if ($statut >= 0)
	{
	    $donationstatic->statut=$statut;
	    $label=$donationstatic->getLibStatut(0);
		print_barre_liste($langs->trans("Donations"), $page, $_SERVER["PHP_SELF"], $param, $sortfield, $sortorder, '', $num,$nbtotalofrecords);
	}
	else
	{
		print_barre_liste($langs->trans("Donations"), $page, $_SERVER["PHP_SELF"], $param, $sortfield, $sortorder, '', $num,$nbtotalofrecords);
	}

	dol_fiche_head($head, 'note', $langs->trans("Donation"), 0, 'generic');
UPDATE llx_const SET value = __ENCRYPT('moono-lisa')__ WHERE value = __ENCRYPT('moono')__ AND name = __ENCRYPT('FCKEDITOR_SKIN')__;

Fixed code:
    $value=trim($value);

	print '<td class="tdtop">' . $langs->trans('NotePublic') . '</td>';
		print '<td class="tdtop">' . $langs->trans('NotePrivate') . '</td>';
	dol_fiche_head($head, $hselected, $langs->trans("Donation"), -1, 'generic');
	dol_fiche_head($head, 'documents',  $langs->trans("Donation"), -1, 'generic');








dol_fiche_head($head, 'info', $langs->trans("Donation"), -1, 'generic');

$statut=(GETPOST("statut",'intcomma')!='')?GETPOST("statut",'intcomma'):"-1";
if ($statut != '' && $statut != '-1')
	$sql .= " AND d.fk_statut IN (".$statut.")";
    $sql.= natural_search('d.ref',$search_ref);
if ($search_amount) $sql.= natural_search('d.amount', $search_amount, 1);
	print_barre_liste($langs->trans("Donations"), $page, $_SERVER["PHP_SELF"], $param, $sortfield, $sortorder, '', $num,$nbtotalofrecords);
	dol_fiche_head($head, 'note', $langs->trans("Donation"), -1, 'generic');


UPDATE llx_const SET value = __ENCRYPT('moono-lisa')__   WHERE value = __ENCRYPT('moono')__       AND name = __ENCRYPT('FCKEDITOR_SKIN')__;
DELETE FROM llx_document_model where nom = 'fsfe.fr.php' and type='donation';