hitoshura25/cvefixes huggingface dataset:
CVE-2017-17898 (PHP, published 2017-12-27T17:08Z)
Description: value: Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/adherents/subscription/info.php
htdocs/cashdesk/tpl/facturation1.tpl.php
htdocs/cashdesk/tpl/liste_articles.tpl.php
htdocs/cashdesk/tpl/menu.tpl.php
htdocs/cashdesk/tpl/ticket.tpl.php
htdocs/cashdesk/tpl/validation1.tpl.php
htdocs/cashdesk/tpl/validation2.tpl.php
htdocs/comm/multiprix.php
htdocs/fourn/index.php
htdocs/main.inc.php
Commit message: FIX security vulnerability reported by ADLab of Venustech

Vulnerable code:
$rowid=isset($_GET["rowid"])?$_GET["rowid"]:$_POST["rowid"];
llxHeader();

$_socid = $_GET["id"];
	$soc->fetch($_GET["id"]);
	header("Location: multiprix.php?id=".$_GET["id"]);
	
	
	
$socid = isset($_GET["socid"])?$_GET["socid"]:'';
		
				
				
				
		
		
        $inj += preg_match('/delete\s+from/i',	 $val);

Fixed code:
$rowid=GETPOST("rowid",'int');
llxHeader();

// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


$id = GETPOST('id','int');
$_socid = GETPOST("id",'int');
	$soc->fetch($id);
	header("Location: multiprix.php?id=".$id);



$socid = GETPOST("socid", 'int');






    	$inj += preg_match('/updatexml^(/i',	 $val);
    	$inj += preg_match('/delete\s+from/i',	 $val);
CVE-2017-17899 (PHP, published 2017-12-27T17:08Z)
Description: value: SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/adherents/subscription/info.php
htdocs/cashdesk/tpl/facturation1.tpl.php
htdocs/cashdesk/tpl/liste_articles.tpl.php
htdocs/cashdesk/tpl/menu.tpl.php
htdocs/cashdesk/tpl/ticket.tpl.php
htdocs/cashdesk/tpl/validation1.tpl.php
htdocs/cashdesk/tpl/validation2.tpl.php
htdocs/comm/multiprix.php
htdocs/fourn/index.php
htdocs/main.inc.php
Commit message: FIX security vulnerability reported by ADLab of Venustech

Vulnerable code:
$rowid=isset($_GET["rowid"])?$_GET["rowid"]:$_POST["rowid"];
llxHeader();

$_socid = $_GET["id"];
	$soc->fetch($_GET["id"]);
	header("Location: multiprix.php?id=".$_GET["id"]);
	
	
	
$socid = isset($_GET["socid"])?$_GET["socid"]:'';
		
				
				
				
		
		
        $inj += preg_match('/delete\s+from/i',	 $val);

Fixed code:
$rowid=GETPOST("rowid",'int');
llxHeader();

// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


$id = GETPOST('id','int');
$_socid = GETPOST("id",'int');
	$soc->fetch($id);
	header("Location: multiprix.php?id=".$id);



$socid = GETPOST("socid", 'int');






    	$inj += preg_match('/updatexml^(/i',	 $val);
    	$inj += preg_match('/delete\s+from/i',	 $val);
CVE-2017-17900 (PHP, published 2017-12-27T17:08Z)
Description: value: SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/adherents/subscription/info.php
htdocs/cashdesk/tpl/facturation1.tpl.php
htdocs/cashdesk/tpl/liste_articles.tpl.php
htdocs/cashdesk/tpl/menu.tpl.php
htdocs/cashdesk/tpl/ticket.tpl.php
htdocs/cashdesk/tpl/validation1.tpl.php
htdocs/cashdesk/tpl/validation2.tpl.php
htdocs/comm/multiprix.php
htdocs/fourn/index.php
htdocs/main.inc.php
Commit message: FIX security vulnerability reported by ADLab of Venustech

Vulnerable code:
$rowid=isset($_GET["rowid"])?$_GET["rowid"]:$_POST["rowid"];
llxHeader();

$_socid = $_GET["id"];
	$soc->fetch($_GET["id"]);
	header("Location: multiprix.php?id=".$_GET["id"]);
	
	
	
$socid = isset($_GET["socid"])?$_GET["socid"]:'';
		
				
				
				
		
		
        $inj += preg_match('/delete\s+from/i',	 $val);

Fixed code:
$rowid=GETPOST("rowid",'int');
llxHeader();

// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}



// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


// Protection to avoid direct call of template
if (empty($langs) || ! is_object($langs))
{
	print "Error, template page can't be called as URL";
	exit;
}


$id = GETPOST('id','int');
$_socid = GETPOST("id",'int');
	$soc->fetch($id);
	header("Location: multiprix.php?id=".$id);



$socid = GETPOST("socid", 'int');






    	$inj += preg_match('/updatexml^(/i',	 $val);
    	$inj += preg_match('/delete\s+from/i',	 $val);
CVE-2017-9435 (PHP, published 2017-06-05T14:29Z)
Description: value: Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/core/lib/functions.lib.php
htdocs/user/index.php
Commit message: FIX SQL injection on user/index.php parameter search_statut.

Vulnerable code:
$search_statut=GETPOST('search_statut','alpha');
$search_supervisor=GETPOST('search_supervisor','alpha');
    if (GETPOST("button_removefilter_x") || GETPOST("button_removefilter.x") ||GETPOST("button_removefilter")) // All test are required to be compatible with all browsers
if ($search_supervisor > 0)   $sql.= " AND u.fk_user = ".$search_supervisor;
if ($search_thirdparty != '') $sql.=natural_search(array('s.nom'), $search_thirdparty);
if ($search_email != '')  $sql.= natural_search("u.email", $search_email);
if ($search_statut != '' && $search_statut >= 0) $sql.= " AND (u.statut=".$search_statut.")";
if ($sall)                    $sql.= natural_search(array_keys($fieldstosearchall), $sall);

Fixed code:
	        case 'intcomma':
	            if (preg_match('/[^0-9,]+/i',$out)) $out='';
	            break;
$search_statut=GETPOST('search_statut','intcomma');
$search_supervisor=GETPOST('search_supervisor','intcomma');
    if (GETPOST("button_removefilter_x") || GETPOST("button_removefilter.x") ||GETPOST("button_removefilter")) // All tests are required to be compatible with all browsers
if ($search_supervisor > 0)   $sql.= " AND u.fk_user = ".$db->escape($search_supervisor);
if ($search_thirdparty != '') $sql.= natural_search(array('s.nom'), $search_thirdparty);
if ($search_email != '')             $sql.= natural_search("u.email", $search_email);
if ($search_statut != '' && $search_statut >= 0) $sql.= " AND u.statut IN (".$db->escape($search_statut).")";
if ($sall)                           $sql.= natural_search(array_keys($fieldstosearchall), $sall);
CVE-2018-10092 (PHP, published 2018-05-22T20:29Z)
Description: value: The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
Severity: MEDIUM (CVSS v3 base score: 8)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/admin/security_file.php
Commit message: FIX CVE-2018-10092

Vulnerable code:
	$res5=dolibarr_set_const($db, "MAIN_ANTIVIRUS_COMMAND", trim(GETPOST('MAIN_ANTIVIRUS_COMMAND','none')),'chaine',0,'',$conf->entity);    // Use GETPOST none because we must accept "
	$res6=dolibarr_set_const($db, "MAIN_ANTIVIRUS_PARAM", trim(GETPOST('MAIN_ANTIVIRUS_PARAM','none')),'chaine',0,'',$conf->entity);	// Use GETPOST none because we must accept "
	$file = $conf->admin->dir_temp . '/' . GETPOST('urlfile');	// Do not use urldecode here ($_GET and $_REQUEST are already decoded by PHP).
	if ($ret) setEventMessages($langs->trans("FileWasRemoved", GETPOST('urlfile')), null, 'mesgs');
	else setEventMessages($langs->trans("ErrorFailToDeleteFile", GETPOST('urlfile')), null, 'errors');

Fixed code:
	$antivircommand = GETPOST('MAIN_ANTIVIRUS_COMMAND','none');			// Use GETPOST none because we must accept ". Example c:\Progra~1\ClamWin\bin\clamscan.exe
	$antivirparam = GETPOST('MAIN_ANTIVIRUS_PARAM','none');				// Use GETPOST none because we must accept ". Example --database="C:\Program Files (x86)\ClamWin\lib"
	$antivircommand = dol_string_nospecial($antivircommand, '', array("|", ";", "<", ">", "&"));	// Sanitize command
	$antivirparam = dol_string_nospecial($antivirparam, '', array("|", ";", "<", ">", "&"));		// Sanitize params

	$res5=dolibarr_set_const($db, "MAIN_ANTIVIRUS_COMMAND", trim($antivircommand),'chaine',0,'',$conf->entity);
	$res6=dolibarr_set_const($db, "MAIN_ANTIVIRUS_PARAM", trim($antivirparam),'chaine',0,'',$conf->entity);
	$file = $conf->admin->dir_temp . '/' . GETPOST('urlfile','alpha');	// Do not use urldecode here ($_GET and $_REQUEST are already decoded by PHP).
	if ($ret) setEventMessages($langs->trans("FileWasRemoved", GETPOST('urlfile','alpha')), null, 'mesgs');
	else setEventMessages($langs->trans("ErrorFailToDeleteFile", GETPOST('urlfile','alpha')), null, 'errors');
CVE-2018-10094 (PHP, published 2018-05-22T20:29Z)
Description: value: SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/adherents/list.php
Commit message: FIX CVE-2018-10094

Vulnerable code:
$statut=GETPOST("statut",'alpha');

Fixed code:
$statut=GETPOST("statut",'intcomma');
CVE-2018-10095 (PHP, published 2018-05-22T20:29Z)
Description: value: Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/adherents/cartes/carte.php
Commit message: FIX CVE-2018-10095

Vulnerable code:
$langs->load("members");
$langs->load("errors");
$foruserid=GETPOST('foruserid');
$foruserlogin=GETPOST('foruserlogin');
$mode=GETPOST('mode');
$model=GETPOST("model");			// Doc template to use for business cards
$modellabel=GETPOST("modellabel");	// Doc template to use for address sheet

Fixed code:
$langs->loadLangs(array("members","errors"));
$foruserid=GETPOST('foruserid','alphanohtml');
$foruserlogin=GETPOST('foruserlogin','alphanohtml');
$mode=GETPOST('mode','aZ09');
$model=GETPOST("model",'aZ09');				// Doc template to use for business cards
$modellabel=GETPOST("modellabel",'aZ09');	// Doc template to use for address sheet
CVE-2018-19992 (PHP, published 2019-01-03T19:29Z)
Description: value: A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to adherents/type.php.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/adherents/card.php
htdocs/adherents/type.php
Commit message: FIX CVE-2018-19992

Vulnerable code:
		print '<textarea name="address" wrap="soft" class="quatrevingtpercent" rows="2">'.(GETPOST('address','alpha')?GETPOST('address','alpha'):$object->address).'</textarea>';
		print $formcompany->select_ziptown((GETPOST('zipcode','alpha')?GETPOST('zipcode','alpha'):$object->zip),'zipcode',array('town','selectcountry_id','state_id'),6);
		print $formcompany->select_ziptown((GETPOST('town','alpha')?GETPOST('town','alpha'):$object->town),'town',array('zipcode','selectcountry_id','state_id'));
$type				= GETPOST('type','alpha');
$comment=GETPOST("comment");
$mail_valid=GETPOST("mail_valid");

Fixed code:
		print '<textarea name="address" wrap="soft" class="quatrevingtpercent" rows="2">'.(GETPOST('address','alphanohtml')?GETPOST('address','alphanohtml'):$object->address).'</textarea>';
		print $formcompany->select_ziptown((GETPOST('zipcode','alphanohtml')?GETPOST('zipcode','alphanohtml'):$object->zip),'zipcode',array('town','selectcountry_id','state_id'),6);
		print $formcompany->select_ziptown((GETPOST('town','alphanohtml')?GETPOST('town','alphanohtml'):$object->town),'town',array('zipcode','selectcountry_id','state_id'));
$type				= GETPOST('type','intcomma');
$comment=GETPOST("comment",'alphanohtml');
$mail_valid=GETPOST("mail_valid",'none');
CVE-2018-19993 (PHP, published 2019-01-03T19:29Z)
Description: value: A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/public/notice.php
Commit message: FIX CVE-2018-19993

Vulnerable code:
/* Copyright (C) 2016	Laurent Destailleur		<eldy@users.sourceforge.net>
 *              You can also call this page with URL: 
define('NOLOGIN',1);		
if (! GETPOST('transkey') && ! GETPOST('transphrase'))
    
    if (GETPOST('transphrase')) print GETPOST('transphrase'); 
    if (GETPOST('transkey')) print $langs->trans(GETPOST('transkey'));

Fixed code:
/* Copyright (C) 2016-2018	Laurent Destailleur		<eldy@users.sourceforge.net>
 *              You can also call this page with URL:
define('NOLOGIN',1);
if (! GETPOST('transkey','alphanohtml') && ! GETPOST('transphrase','alphanohtml'))

    if (GETPOST('transphrase','alphanohtml')) print GETPOST('transphrase','alphanohtml');
    if (GETPOST('transkey','alphanohtml')) print $langs->trans(GETPOST('transkey','alphanohtml'));
CVE-2018-19994 (PHP, published 2019-01-03T19:29Z)
Description: value: An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the desiredstock parameter.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/product/class/product.class.php
Commit message: FIX CVE-2018-19994

Vulnerable code:
			$sql.= ", tosell = " . $this->status;
			$sql.= ", tobuy = " . $this->status_buy;
			$sql.= ", tobatch = " . ((empty($this->status_batch) || $this->status_batch < 0) ? '0' : $this->status_batch);
	        $sql.= ", fk_country = " . ($this->country_id > 0 ? $this->country_id : 'null');
			$sql.= ", desiredstock = " . ((isset($this->desiredstock) && $this->desiredstock != '') ? $this->desiredstock : "null");
	        $sql.= ", fk_unit= " . (!$this->fk_unit ? 'NULL' : $this->fk_unit);
			$sql.= ", fk_price_expression = ".($this->fk_price_expression != 0 ? $this->fk_price_expression : 'NULL');

Fixed code:
			$sql.= ", tosell = " . (int) $this->status;
			$sql.= ", tobuy = " . (int) $this->status_buy;
			$sql.= ", tobatch = " . ((empty($this->status_batch) || $this->status_batch < 0) ? '0' : (int) $this->status_batch);
	        $sql.= ", fk_country = " . ($this->country_id > 0 ? (int) $this->country_id : 'null');
			$sql.= ", desiredstock = " . ((isset($this->desiredstock) && $this->desiredstock != '') ? (int) $this->desiredstock : "null");
	        $sql.= ", fk_unit= " . ((! $this->fk_unit) ? 'NULL' : (int) $this->fk_unit);
			$sql.= ", fk_price_expression = ".($this->fk_price_expression != 0 ? (int) $this->fk_price_expression : 'NULL');
CVE-2020-12669 (PHP, published 2020-05-06T19:15Z)
Description: value: core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/core/get_menudiv.php
Commit message: Merge branch '11.0' of git@github.com:Dolibarr/dolibarr.git into develop

Conflicts:
	htdocs/core/get_menudiv.php


Vulnerable code:
 if (GETPOST('menu')) $file_menu = GETPOST('menu'); // example: menu=eldy_menu.php

Fixed code:
 if (GETPOST('menu', 'aZ09')) $file_menu = GETPOST('menu', 'aZ09');     // example: menu=eldy_menu.php
CVE-2020-14443 (PHP, published 2020-06-18T18:15Z)
Description: value: A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Dolibarr/dolibarr
Files changed:
htdocs/accountancy/customer/card.php
htdocs/accountancy/expensereport/card.php
htdocs/accountancy/supplier/card.php
htdocs/comm/mailing/info.php
htdocs/compta/paiement/info.php
htdocs/variants/ajax/get_attribute_values.php
Commit message: FIX BlindBoolean SQL injection reported by Christian Weiler
<sak1.s3curity@gmail.com>

Vulnerable code:
$codeventil = GETPOST('codeventil');
$id = GETPOST('id');
$codeventil = GETPOST('codeventil');
$id = GETPOST('id');
$codeventil = GETPOST('codeventil');
$id = GETPOST('id');
$id = GETPOST('id');
$id = GETPOST('id');
$id = GETPOST('id');

Fixed code:
$codeventil = GETPOST('codeventil', 'int');
$id = GETPOST('id', 'int');
$codeventil = GETPOST('codeventil', 'int');
$id = GETPOST('id', 'int');
$codeventil = GETPOST('codeventil', 'int');
$id = GETPOST('id', 'int');
$id = GETPOST('id', 'int');
$id = GETPOST('id', 'int');
$id = GETPOST('id', 'int');