TrinityCore/TrinityCore — Issue #4287: Possible SQL Injection
Author: Hyperr
Created: 2011-12-12 15:00:32+00:00
State: open

With the .tele add are sql injections possible.
The name will be parsed, converted and used in the sql statement without any escaping.

For example: .tele add cheat'); INSERT INTO gameobject ......; --
And spawn a new mineral objects with respawn time of 0 or spawn a boss chest.

Maybe access to the characters database is also available over the world connection and character changes by UPDATE characters.characters SET level / money = .... are possible.

Fix:
std::string safeName(tele.name);
WorldDatabase.escape_string(safeName);

and use safeName in sql statement instead of tele.name.

Source: https://github.com/TrinityCore/TrinityCore/blob/master/src/server/game/Globals/ObjectMgr.cpp#L8043