CVE-2019-20107 (PHP, published 2020-03-05T13:15Z)
Description: value: Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Files changed:
lib/plan/tc_exec_unassign_all.php
lib/results/testCasesWithCF.php
Commit message: fix: security #8829


Vulnerable code:
 * @author		Andreas Simon
 * @copyright	2005-2010, TestLink community 
 * @version		CVS: $Id: tc_exec_unassign_all.php,v 1.3 2010/07/26 19:00:57 asimon83 Exp $
 * @link		http://www.teamst.org/index.php
 *
 * @internal revisions:
	$args->build_id = isset($_REQUEST['build_id']) ? $_REQUEST['build_id'] : 0;
	$args->testproject_id = $_SESSION['testprojectID'];
 * @internal revisions
 * @since 1.9.7
    $argsObj = new stdClass();
    $argsObj->showPlatforms = false;
    $argsObj->tproject_id = isset($_SESSION['testprojectID']) ? $_SESSION['testprojectID'] : 0;
    $argsObj->tproject_name = isset($_SESSION['testprojectName']) ? $_SESSION['testprojectName'] : '';
    $argsObj->tplan_name = '';
    $argsObj->tplan_id = isset($_REQUEST['tplan_id']) ? $_REQUEST['tplan_id'] : 0;
    if($argsObj->tplan_id == 0)
    {
        $argsObj->tplan_id = isset($_SESSION['testplanID']) ? $_SESSION['testplanID'] : 0;
    }
    if($argsObj->tplan_id > 0)
    {
    }
    return $argsObj;
}
?>

Fixed code:
 * @copyright	2005-2019, TestLink community 
	$args->build_id = isset($_REQUEST['build_id']) ? 
	                  intval($_REQUEST['build_id']) : 0;
	$args->testproject_id = intval($_SESSION['testprojectID']);
  $argsObj = new stdClass();
  $argsObj->showPlatforms = false;
  $argsObj->tproject_id = isset($_SESSION['testprojectID']) ? $_SESSION['testprojectID'] : 0;
  $argsObj->tproject_id = intval($argsObj->tproject_id);
  $argsObj->tproject_name = isset($_SESSION['testprojectName']) ? $_SESSION['testprojectName'] : '';

  $argsObj->tplan_name = '';
  $argsObj->tplan_id = isset($_REQUEST['tplan_id']) ? $_REQUEST['tplan_id'] : 0;
  $argsObj->tplan_id = intval($argsObj->tplan_id);

  if ($argsObj->tplan_id == 0) {
    $argsObj->tplan_id = isset($_SESSION['testplanID']) ? $_SESSION['testplanID'] : 0;
  }

  if($argsObj->tplan_id > 0) {
  }
  return $argsObj;
}