hitoshura25/cvefixes huggingface dataset:
CVE-2019-19924 (C, published 2019-12-24T16:15Z)
Description: value: SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error handling.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/expr.c
src/vdbeaux.c
src/window.c
Commit message: When an error occurs while rewriting the parser tree for window functions
in the sqlite3WindowRewrite() routine, make sure that pParse->nErr is set,
and make sure that this shuts down any subsequent code generation that might
depend on the transformations that were implemented.  This fixes a problem
discovered by the Yongheng and Rui fuzzer.

FossilOrigin-Name: e2bddcd4c55ba3cbe0130332679ff4b048630d0ced9a8899982edb5a3569ba7f

Vulnerable code:
C Detect\sthe\sinvalid\suse\sof\sNULLS\sLAST\son\san\sINTEGER\sPRIMARY\sKEY\sdefinition\nof\sa\sWITHOUT\sROWID\stable.
D 2019-12-19T17:42:27.314
F src/expr.c 8f873d6a411483a0ba14367aebf63c1f9f4346ef755739ec11feb14fa662002d
F src/vdbeaux.c ede199fe272656338741dd831da86362a3b60e42fb12ef5389ea1325823e9686
F src/window.c 913a10696f5197adae32738a7c7cabc03e1f1553240d6c9ce868ee57f5cee88e
P a80f84b511231204658304226de3e075a55afc2e3f39ac063716f7a57f585c06
R 7a95b86f1a40201b7706c8c6219ee188
Z a9ed89712b19f96611f174486447a3a5
4417c5bf0aabb34ed174f01afd981c924ae965a42128719d8d6735536631d12f
  assert( p->aOp==0 || p->aOp[p->nOp-1].zComment==0 || p->db->mallocFailed );
      return SQLITE_NOMEM;

Fixed code:
C When\san\serror\soccurs\swhile\srewriting\sthe\sparser\stree\sfor\swindow\sfunctions\nin\sthe\ssqlite3WindowRewrite()\sroutine,\smake\ssure\sthat\spParse->nErr\sis\sset,\nand\smake\ssure\sthat\sthis\sshuts\sdown\sany\ssubsequent\scode\sgeneration\sthat\smight\ndepend\son\sthe\stransformations\sthat\swere\simplemented.\s\sThis\sfixes\sa\sproblem\ndiscovered\sby\sthe\sYongheng\sand\sRui\sfuzzer.
D 2019-12-19T20:37:32.070
F src/expr.c 5099de2d6cca77f7c3b5131e0035787fc64ca3d27c267020e7e8bec0e226336c
F src/vdbeaux.c 858bb43a9d98846cc23fa8c8d0970ada805dd75bc6a01b69e972da608f7f59b1
F src/window.c da010455914c81037dcb5b0c6f4273f8a32c94567865c46a60060b937b018a96
P 4417c5bf0aabb34ed174f01afd981c924ae965a42128719d8d6735536631d12f
R f9500979ead80e4e63134871bf8fc127
Z b61065dbf7c71aac52e79a354be5735d
e2bddcd4c55ba3cbe0130332679ff4b048630d0ced9a8899982edb5a3569ba7f
  if( pParse->nErr ) return 0;
  assert( p->aOp==0 || p->aOp[p->nOp-1].zComment==0 || p->db->mallocFailed
          || p->pParse->nErr>0 );
      return sqlite3ErrorToParser(db, SQLITE_NOMEM);
  if( rc && pParse->nErr==0 ){
    assert( pParse->db->mallocFailed );
    return sqlite3ErrorToParser(pParse->db, SQLITE_NOMEM);
  }
CVE-2019-19925 (Other, published 2019-12-24T17:15Z)
Description: value: zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/sqlite/sqlite
Files changed:
ext/misc/zipfile.c
manifest
manifest.uuid
test/zipfile.test
Commit message: Fix the zipfile extension so that INSERT works even if the pathname of
the file being inserted is a NULL.  Bug discovered by the
Yongheng and Rui fuzzer.

FossilOrigin-Name: a80f84b511231204658304226de3e075a55afc2e3f39ac063716f7a57f585c06

Vulnerable code:
C Fix\sincorrect\sSQL\sgenerated\sby\sthe\sLemon\schange\sof\sthe\sprevious\scheck-in.
D 2019-12-19T13:17:07.364
F ext/misc/zipfile.c 7ad29133e304e40c8fe239bea10e101580ed56bc68c16d992af514cce19572d0
F test/zipfile.test b3b558639f7a103e095713ad0f57fec1fce1b7d60c8054df5789b98f7547a395
P 329cbb372d4d77f774f01a87d104c40ef42d713afbe76195b65f5ca205c5ea7b
R d028a5f013795e21f082346da52e7329
Z 50186217141264fb7bf8cc1df4e95908
fccfb8a9ed3c1df9f23762bb8df6fdf36a21118899e3fae41f451169a5f2c08e

Fixed code:
      if( zPath==0 ) zPath = "";
C Fix\sthe\szipfile\sextension\sso\sthat\sINSERT\sworks\seven\sif\sthe\spathname\sof\nthe\sfile\sbeing\sinserted\sis\sa\sNULL.\s\sBug\sdiscovered\sby\sthe\nYongheng\sand\sRui\sfuzzer.
D 2019-12-19T15:15:40.450
F ext/misc/zipfile.c 8f965eb309da3ae8c30088f6c3ebdddcdbdf9e0ef24f3bc7ae0756deb93da503
F test/zipfile.test daab4c9be151934fd6bbc71a0d2520351efc61719eabbf545920f953883d172a
P fccfb8a9ed3c1df9f23762bb8df6fdf36a21118899e3fae41f451169a5f2c08e
R 0fec610fab0a45c2e8f5600ef1cab28e
Z aed8df93d89c2e0fad2b3edf29a44f34
a80f84b511231204658304226de3e075a55afc2e3f39ac063716f7a57f585c06
# 2019-12-18 Yongheng and Rui fuzzer
#
do_execsql_test 13.10 {
  DROP TABLE IF EXISTS t0;
  DROP TABLE IF EXISTS t1;
  CREATE TABLE t0(a,b,c,d,e,f,g);
  REPLACE INTO t0(c,b,f) VALUES(10,10,10);
  CREATE VIRTUAL TABLE t1 USING zipfile('h.zip');
  REPLACE INTO t1 SELECT * FROM t0;
  SELECT quote(name),quote(mode),quote(mtime),quote(sz),quote(rawdata),
         quote(data),quote(method) FROM t1;
} {'' 10 10 2 X'3130' X'3130' 0}
CVE-2019-19926 (Other, published 2019-12-23T01:15Z)
Description: value: multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/select.c
Commit message: Continuation of [e2bddcd4c55ba3cb]: Add another spot where it is necessary
to abort early due to prior errors in sqlite3WindowRewrite().

FossilOrigin-Name: cba2a2a44cdf138a629109bb0ad088ed4ef67fc66bed3e0373554681a39615d2

Vulnerable code:
C Fix\sthe\sregexp\sextension\sso\sthat\sit\scorrectly\stranslates\sall\sover-length\n3-byte\sUTF8\ssequences\sinto\s0xfffd.
D 2019-12-19T21:11:48.622
F src/select.c dd7e40967760b28efe274ade35043d5bf5d72774208bb75d2cb4dd59cbd59ad1
P e2bddcd4c55ba3cbe0130332679ff4b048630d0ced9a8899982edb5a3569ba7f
R af9053af10312d4307bee0a49d732fcd
Z 117f0e64b781f6b402ee8f8a6b6c39a1
3d4c0bf8904135fa68c75801bfa738715cacc3b19dc8ad6ef550b11798d4b121

Fixed code:
C Continuation\sof\s[e2bddcd4c55ba3cb]:\sAdd\sanother\sspot\swhere\sit\sis\snecessary\nto\sabort\searly\sdue\sto\sprior\serrors\sin\ssqlite3WindowRewrite().
D 2019-12-19T22:08:19.301
F src/select.c b895d809b93596c828c4cd79f4da96d48bf1969414877bb4313770000ea736cc
P 3d4c0bf8904135fa68c75801bfa738715cacc3b19dc8ad6ef550b11798d4b121
R 5ae11b0f596e58f50666a1f36d76218a
Z a0201de5777363689738ee935bfc3b28
cba2a2a44cdf138a629109bb0ad088ed4ef67fc66bed3e0373554681a39615d2
  if( pParse->nErr ) goto multi_select_end;
CVE-2019-19959 (Other, published 2020-01-03T22:15Z)
Description: value: ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
test/zipfile.test
Commit message: Test case for the zipfile-extension bug fix of the previous check-in.

FossilOrigin-Name: bc8bfc7fcdf33f6855584e10e9260073430517ff3268cf0c7988dcc4cd785391

Vulnerable code:
C Fix\sthe\szipfile()\sfunction\sin\sthe\szipfile\sextension\sso\sthat\sit\sis\sable\sto\ndeal\swith\sgoofy\sfilenames\sthat\scontain\sembedded\szeros.
D 2019-12-23T21:04:33.977
F test/zipfile.test daab4c9be151934fd6bbc71a0d2520351efc61719eabbf545920f953883d172a
P 4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c
R 29d7c3cbcd5652a73d3305fec9c54b58
Z b32fa973d6865a272376759a8cfda3e5
cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf

Fixed code:
C Test\scase\sfor\sthe\szipfile-extension\sbug\sfix\sof\sthe\sprevious\scheck-in.
D 2019-12-23T21:11:15.463
F test/zipfile.test 330bec11cee9da4da1a48e648b6d445b9334044089da62e9521803566a36dde2
P cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
R 01755885676b946174adbb226548e4c0
Z 9cbb5c3517ed7c9d1c8f71b1fd10d978
bc8bfc7fcdf33f6855584e10e9260073430517ff3268cf0c7988dcc4cd785391
# 2019-12-23 Yongheng and Rui fuzzer
# Run using valgrind to see the problem.
#
do_execsql_test 14.10 {
  DROP TABLE t1;
  CREATE TABLE t1(x char);
  INSERT INTO t1(x) VALUES('1');
  INSERT INTO t1(x) SELECT zipfile(x, 'xyz') FROM t1;
  INSERT INTO t1(x) SELECT zipfile(x, 'uvw') FROM t1;
  SELECT count(*) FROM t1;
  PRAGMA integrity_check;
} {3 ok}
CVE-2019-19959 (Other, published 2020-01-03T22:15Z)
Description: value: ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/sqlite/sqlite
Files changed:
ext/misc/zipfile.c
manifest
manifest.uuid
Commit message: Fix the zipfile() function in the zipfile extension so that it is able to
deal with goofy filenames that contain embedded zeros.

FossilOrigin-Name: cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf

Vulnerable code:
        nPath++;
      nName++;
C Thoroughly\sreset\sthe\srtree\scursor\sat\sthe\sstart\sof\seach\sVFilter\soperation,\nincluding\sclearing\sits\scache.\s\sThis\sprevents\sleft\sover\spages\sin\sthe\scache\nwhich\scan\scause\sproblems\son\sshutdown\safter\sa\sLEFT\sJOIN.\nTicket\s[5eadca17c4dde90c]
D 2019-12-23T20:41:39.904
F ext/misc/zipfile.c dfec5589395fc2272a646fc309935ecb5164934a95757762afa120b72d1d0ba4
P 953e6aa6d9ca09e549c88bc728c322fabdcef581f3b4a7763d95488dddbbd6a5
R ca340be656fb975dcd1521355f675df7
Z 22698fecf79ba95f8e537178f371e71c
4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c

Fixed code:
        nPath = (int)strlen(zPath);
      nName = (int)strlen(zName);
C Fix\sthe\szipfile()\sfunction\sin\sthe\szipfile\sextension\sso\sthat\sit\sis\sable\sto\ndeal\swith\sgoofy\sfilenames\sthat\scontain\sembedded\szeros.
D 2019-12-23T21:04:33.977
F ext/misc/zipfile.c 46b8022d5c4f118995c3e7228542215204dacc9c1c4e9872710900ec276d6db3
P 4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c
R 29d7c3cbcd5652a73d3305fec9c54b58
Z b32fa973d6865a272376759a8cfda3e5
cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
CVE-2019-20218 (Other, published 2020-01-02T14:16Z)
Description: value: selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/select.c
test/altertab3.test
Commit message: Do not attempt to unwind the WITH stack in the Parse object following an error. This fixes a separate case to [de6e6d68].

FossilOrigin-Name: d29edef93451cc67a5d69c1cce1b1832d9ca8fff1f600afdd51338b74d077b92

Vulnerable code:
C Remove\sa\sNEVER()\sthat\sis\sno\slonger\strue.\sFix\sfor\s[36ffedcb9].
D 2019-12-27T20:06:32.777
F src/select.c 83e3aba723cd50134b8af4b18433f46123c31889a39c8b4ac28cccedbdf070e8
F test/altertab3.test 10c32d6251344bdc114d2df27e62cb72b5afc676f20709224d362d0cff0aa3e3
P e3b5fc05c00fc58be7a7c94ce1d97a5b05113f39aba03df64aab08364f85616b
R a966e346a033c0ab1a88c0d109a734aa
Z ba0d31a3cdb9b737f0aa85ce7fe964a5
597896ed0ae9e2960a8f39576bd7f77a11dccc1da84b6a44ebb5c38d90ebc330
  if( db->mallocFailed || sqliteProcessJoin(pParse, p) ){

Fixed code:
C Do\snot\sattempt\sto\sunwind\sthe\sWITH\sstack\sin\sthe\sParse\sobject\sfollowing\san\serror.\sThis\sfixes\sa\sseparate\scase\sto\s[de6e6d68].
D 2019-12-27T20:54:42.382
F src/select.c e18a64e8d9f468ce9c183ab27ad79658b2aad8128e0dcfcd0c5dfe0132fc1074
F test/altertab3.test d58d41201afd64c6176dcc4e71110c600c03841dad1efcc354de2248f6126e70
P 597896ed0ae9e2960a8f39576bd7f77a11dccc1da84b6a44ebb5c38d90ebc330
R e2fa6fb2e144752a1d4a9d45874c1bd9
Z e36f281614de7335dc6fbd6aa6abfc9f
d29edef93451cc67a5d69c1cce1b1832d9ca8fff1f600afdd51338b74d077b92
  if( pParse->nErr || db->mallocFailed || sqliteProcessJoin(pParse, p) ){
#------------------------------------------------------------------------
#
reset_db
do_execsql_test 23.1 {
  CREATE TABLE v0 (a);
  CREATE VIEW v2 (v3) AS 
    WITH x1 AS (SELECT * FROM v2) 
    SELECT v3 AS x, v3 AS y FROM v2; 
}

do_catchsql_test 23.2 {
  SELECT * FROM v2
} {1 {view v2 is circularly defined}}

db close
sqlite3 db test.db

do_catchsql_test 23.3 {
  ALTER TABLE v0 RENAME TO t3 ;
} {1 {error in view v2: view v2 is circularly defined}}
CVE-2019-20218 (Other, published 2020-01-02T14:16Z)
Description: value: selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/select.c
test/altertab3.test
Commit message: Do not attempt to unwind the WITH stack in the Parse object following an error. This fixes a separate case to [de6e6d68].

FossilOrigin-Name: d29edef93451cc67a5d69c1cce1b1832d9ca8fff1f600afdd51338b74d077b92

Vulnerable code:
C Remove\sa\sNEVER()\sthat\sis\sno\slonger\strue.\sFix\sfor\s[36ffedcb9].
D 2019-12-27T20:06:32.777
F src/select.c 83e3aba723cd50134b8af4b18433f46123c31889a39c8b4ac28cccedbdf070e8
F test/altertab3.test 10c32d6251344bdc114d2df27e62cb72b5afc676f20709224d362d0cff0aa3e3
P e3b5fc05c00fc58be7a7c94ce1d97a5b05113f39aba03df64aab08364f85616b
R a966e346a033c0ab1a88c0d109a734aa
Z ba0d31a3cdb9b737f0aa85ce7fe964a5
597896ed0ae9e2960a8f39576bd7f77a11dccc1da84b6a44ebb5c38d90ebc330
  if( db->mallocFailed || sqliteProcessJoin(pParse, p) ){

Fixed code:
C Do\snot\sattempt\sto\sunwind\sthe\sWITH\sstack\sin\sthe\sParse\sobject\sfollowing\san\serror.\sThis\sfixes\sa\sseparate\scase\sto\s[de6e6d68].
D 2019-12-27T20:54:42.382
F src/select.c e18a64e8d9f468ce9c183ab27ad79658b2aad8128e0dcfcd0c5dfe0132fc1074
F test/altertab3.test d58d41201afd64c6176dcc4e71110c600c03841dad1efcc354de2248f6126e70
P 597896ed0ae9e2960a8f39576bd7f77a11dccc1da84b6a44ebb5c38d90ebc330
R e2fa6fb2e144752a1d4a9d45874c1bd9
Z e36f281614de7335dc6fbd6aa6abfc9f
d29edef93451cc67a5d69c1cce1b1832d9ca8fff1f600afdd51338b74d077b92
  if( pParse->nErr || db->mallocFailed || sqliteProcessJoin(pParse, p) ){
#------------------------------------------------------------------------
#
reset_db
do_execsql_test 23.1 {
  CREATE TABLE v0 (a);
  CREATE VIEW v2 (v3) AS 
    WITH x1 AS (SELECT * FROM v2) 
    SELECT v3 AS x, v3 AS y FROM v2; 
}

do_catchsql_test 23.2 {
  SELECT * FROM v2
} {1 {view v2 is circularly defined}}

db close
sqlite3 db test.db

do_catchsql_test 23.3 {
  ALTER TABLE v0 RENAME TO t3 ;
} {1 {error in view v2: view v2 is circularly defined}}
CVE-2013-2091 (PHP, published 2019-11-20T20:15Z)
Description: value: SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/adherents/fiche.php
Commit message: Fix security breach (SQL injection)


Vulnerable code:
		if (isset($_POST["pays"]) || $object->country_id)
			$sql = "SELECT rowid, code, libelle as label from ".MAIN_DB_PREFIX."c_pays where rowid = ".(isset($_POST["pays"])?$_POST["pays"]:$object->country_id);

Fixed code:
		$country=GETPOST('pays','int');
		if (!empty($country) || $object->country_id)
			$sql = "SELECT rowid, code, libelle as label from ".MAIN_DB_PREFIX."c_pays where rowid = ".(!empty($country)?$country:$object->country_id);
CVE-2013-2092 (PHP, published 2019-11-20T21:15Z)
Description: value: Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/core/lib/functions.lib.php
Commit message: Fix: Escape entities

Vulnerable code:
		$out.="<b>".$langs->trans("Server").":</b> ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";;
		$out.="<b>".$langs->trans("RequestedUrl").":</b> ".$_SERVER["REQUEST_URI"]."<br>\n";;
		$out.="<b>".$langs->trans("Referer").":</b> ".(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:'')."<br>\n";;

Fixed code:
		$out.="<b>".$langs->trans("Server").":</b> ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";
		$out.="<b>".$langs->trans("RequestedUrl").":</b> ".dol_htmlentities($_SERVER["REQUEST_URI"],ENT_COMPAT,'UTF-8')."<br>\n";
		$out.="<b>".$langs->trans("Referer").":</b> ".(isset($_SERVER["HTTP_REFERER"])?dol_htmlentities($_SERVER["HTTP_REFERER"],ENT_COMPAT,'UTF-8'):'')."<br>\n";
CVE-2013-2093 (PHP, published 2019-11-20T21:15Z)
Description: value: Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/core/lib/barcode.lib.php
Commit message: Sec: Param not escaped
Fix: Bad return error

Vulnerable code:

    if (! $bars)
        $error='Bad Value '.$code.' for encoding '.$encoding;
    else if (file_exists($genbarcode_loc))
    $paramclear=" \"".str_replace("\"", "\\\"",$code)."\" \"".str_replace("\"", "\\\"",strtoupper($encoding))."\"";

    //print $fullcommandclear."<br>\n";
		"encoding" => trim($encoding),
		"text" => trim($text)
    if (!$ret['encoding']) return false;

Fixed code:
    if (! $bars || ! empty($bars['error']))
        if (empty($bars['error'])) $error='Bad Value '.$code.' for encoding '.$encoding;
        else $error=$bars['error'];
    else if (file_exists($genbarcode_loc))	// For example C39
    //$paramclear=" \"".str_replace("\"", "\\\"",$code)."\" \"".str_replace("\"", "\\\"",strtoupper($encoding))."\"";
    $paramclear=" ".escapeshellarg($code)." ".escapeshellarg(strtoupper($encoding));
    
    //print $fullcommandclear."<br>\n";exit;
		"text" => trim($text),
		"encoding" => trim($encoding),
    	"error" => ""
    if (preg_match('/permission denied/i',$ret['bars'])) 
    { 
    	$ret['error']=$ret['bars']; $ret['bars']='';
    	return $ret;
    }
    if (!$ret['encoding']) return false;
CVE-2017-17897 (PHP, published 2017-12-27T17:08Z)
Description: value: SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/adherents/subscription/info.php
htdocs/cashdesk/tpl/facturation1.tpl.php
htdocs/cashdesk/tpl/liste_articles.tpl.php
htdocs/cashdesk/tpl/menu.tpl.php
htdocs/cashdesk/tpl/ticket.tpl.php
htdocs/cashdesk/tpl/validation1.tpl.php
htdocs/cashdesk/tpl/validation2.tpl.php
htdocs/comm/multiprix.php
htdocs/fourn/index.php
htdocs/main.inc.php
Commit message: FIX security vulnerability reported by ADLab of Venustech

Vulnerable code:
$rowid=isset($_GET["rowid"])?$_GET["rowid"]:$_POST["rowid"];
llxHeader();

$_socid = $_GET["id"];
	$soc->fetch($_GET["id"]);
	header("Location: multiprix.php?id=".$_GET["id"]);
	
	
	
$socid = isset($_GET["socid"])?$_GET["socid"]:'';
		
				
				
				
		
		
        $inj += preg_match('/delete\s+from/i',	 $val);

Fixed code:
$rowid=GETPOST("rowid",'int');
llxHeader();

// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


$id = GETPOST('id','int');
$_socid = GETPOST("id",'int');
	$soc->fetch($id);
	header("Location: multiprix.php?id=".$id);



$socid = GETPOST("socid", 'int');






    	$inj += preg_match('/updatexml^(/i',	 $val);
    	$inj += preg_match('/delete\s+from/i',	 $val);