Language: PHP
Label: vulnerable
CWE: CWE-29 \u2014 Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Code:
    public function getDuplicateQuery($focus, $prefix='')
    {
        $query = "SELECT id, first_name, last_name, account_name, title FROM leads ";

        // Bug #46427 : Records from other Teams shown on Potential Duplicate Contacts screen during Lead Conversion
        // add team security

        $query .= " WHERE deleted != 1 AND (status <> 'Converted' OR status IS NULL) AND ";

        //Use the first and last name from the $_POST to filter.  If only last name supplied use that
        if (isset($_POST[$prefix.'first_name']) && strlen($_POST[$prefix.'first_name']) != 0 && isset($_POST[$prefix.'last_name']) && strlen($_POST[$prefix.'last_name']) != 0) {
            $query .= " (first_name='". $_POST[$prefix.'first_name'] . "' AND last_name = '". $_POST[$prefix.'last_name'] ."')";
        } else {
            $query .= " last_name = '". $_POST[$prefix.'last_name'] ."'";
        }
        return $query;
    }