CVE-2017-20169 (PHP, published 2023-01-13T21:15Z)
Description: value: A vulnerability, which was classified as critical, has been found in GGGGGGGG ToN-MasterServer. Affected by this issue is some unknown functionality of the file public_html/irc_updater/svr_request_pub.php. The manipulation leads to sql injection. The patch is identified as 3a4c7e6d51bf95760820e3245e06c6e321a7168a. It is recommended to apply a patch to fix this issue. VDB-218306 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/GGGGGGGG/ToN-MasterServer
Files changed:
common/config.php
public_html/irc_updater/svr_request_pub.php
Commit message: protection against sql injections


Vulnerable code:
$config['isProxy'] = True;
	$ip = $_SERVER["REMOTE_ADDR"];
	$port = intval(post_input("port"));
	$num_conn = intval(post_input("num_conn"));
	$max_conn = intval(post_input("num_max"));
	$name = post_input("name");
	$desc = post_input("desc");
	$status = post_input("status");
	$minkarma = post_input("minkarma");
	$location = post_input("location");
	$cgt = post_input("cgt");
	$next_map = post_input("next_map");
	$map = post_input("map");
	$login = post_input("login");
	$pass = post_input("pass");
	$minlevel = intval(post_input("minlevel"));
	$maxlevel = intval(post_input("maxlevel"));
	global $config;
	global $dbcon;		
	$num_conn = intval(post_input("num_conn"));
	$login = post_input("login");
	$id = intval(post_input("server_id"));
	$account_id = intval(post_input("account_id"));
	$server_id = intval(post_input("server_id"));
	$c_conn['account_id'] = post_input("account_id");
	$c_conn['server_id'] = post_input("server_id");
	$c_conn['num_conn'] = post_input("num_conn");
	$c_conn['cookie'] = post_input("cookie");
	$c_conn['ip'] = post_input("ip");
	$account_id = intval(post_input("account_id"));
	$server_id = intval(post_input("server_id"));
	$a['login'] = post_input('login');
	$a['pass'] = post_input('pass');
	$a['type'] = post_input('type'); // = "reg"
	$a['port'] = post_input('port');
	$a['map'] = post_input('map');
	$a['account_ids'] = $_POST['account_id'];

Fixed code:
	global $dbcon;

	$ip = mysqli_real_escape_string($dbcon, $_SERVER["REMOTE_ADDR"]);
	$port = mysqli_real_escape_string($dbcon,intval(post_input("port")));
	$num_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_conn")));
	$max_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_max")));
	$name = mysqli_real_escape_string($dbcon, post_input("name"));
	$desc = mysqli_real_escape_string($dbcon, post_input("desc"));
	$status = mysqli_real_escape_string($dbcon, post_input("status"));
	$minkarma = mysqli_real_escape_string($dbcon, post_input("minkarma"));
	$location = mysqli_real_escape_string($dbcon, post_input("location"));
	$cgt = mysqli_real_escape_string($dbcon, post_input("cgt"));
	$next_map = mysqli_real_escape_string($dbcon, post_input("next_map"));
	$map = mysqli_real_escape_string($dbcon, post_input("map"));
	$login = mysqli_real_escape_string($dbcon, post_input("login"));
	$pass = mysqli_real_escape_string($dbcon, post_input("pass"));
	$minlevel = mysqli_real_escape_string($dbcon, intval(post_input("minlevel")));
	$maxlevel = mysqli_real_escape_string($dbcon, intval(post_input("maxlevel")));
	global $dbcon;
	$num_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_conn")));
	$login = mysqli_real_escape_string($dbcon, post_input("login"));
	$id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
	$account_id = mysqli_real_escape_string($dbcon, intval(post_input("account_id")));
	$server_id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
	$c_conn['account_id'] = mysqli_real_escape_string($dbcon, post_input("account_id"));
	$c_conn['server_id'] = mysqli_real_escape_string($dbcon, post_input("server_id"));
	$c_conn['num_conn'] = mysqli_real_escape_string($dbcon, post_input("num_conn"));
	$c_conn['cookie'] = mysqli_real_escape_string($dbcon, post_input("cookie"));
	$c_conn['ip'] = mysqli_real_escape_string($dbcon, post_input("ip"));

	global $dbcon;

	$account_id = mysqli_real_escape_string($dbcon, intval(post_input("account_id")));
	$server_id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
	global $dbcon;

	$a['login'] = mysqli_real_escape_string($dbcon, post_input('login'));
	$a['pass'] = mysqli_real_escape_string($dbcon, post_input('pass'));
	$a['type'] = mysqli_real_escape_string($dbcon, post_input('type')); // = "reg"
	$a['port'] = mysqli_real_escape_string($dbcon,post_input('port'));
	$a['map'] = mysqli_real_escape_string($dbcon, post_input('map'));
	$a['account_ids'] = mysqli_real_escape_string($dbcon, $_POST['account_id']);