Language: PHP
Label: vulnerable
CWE: CWE-29 \u2014 Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Code:
    public function getDuplicateQuery($focus, $prefix='')
    {
        $query = 'SELECT contacts.id, contacts.first_name, contacts.last_name, contacts.title FROM contacts ';

        // Bug #46427 : Records from other Teams shown on Potential Duplicate Contacts screen during Lead Conversion
        // add team security

        $query .= ' where contacts.deleted = 0 AND ';
        if (isset($_POST[$prefix.'first_name']) && strlen($_POST[$prefix.'first_name']) != 0 && isset($_POST[$prefix.'last_name']) && strlen($_POST[$prefix.'last_name']) != 0) {
            $query .= " contacts.first_name LIKE '". $_POST[$prefix.'first_name'] . "%' AND contacts.last_name = '". $_POST[$prefix.'last_name'] ."'";
        } else {
            $query .= " contacts.last_name = '". $_POST[$prefix.'last_name'] ."'";
        }

        if (!empty($_POST[$prefix.'record'])) {
            $query .= " AND  contacts.id != '". $_POST[$prefix.'record'] ."'";
        }
        return $query;
    }