EllisLab/CodeIgniter — Issue #1104: Active Record exploit [urgent]
Author: peengo
Created: 2012-03-02 13:53:55+00:00
State: open

I've found this active record exploit in fresh install of Codeigniter 2.1.0. Only database package is autoloaded here FYI. No other code in the project than this below.

If you do this code on a form that posts to itself, the 2 post fields are not-set at first website load, and $this->input->post('username') returns FALSE !!!

so this query below outputs 1st user record from the "users" table. That is not correct (should not display any results).

Even if you comment out the second line which is $this->db->where('email_confirm', $this->input->post('password'));
you get all results from the "users" table. i've been even trying this with removing the input fields in my browser and submiting the form, it acts weird also.

this can probably be solved with form_validation helper but on the other hand, i found this when i was making a form with some invisible input fields, which values were generated from URI segments and then send via AJAX.

And some other thing i noticed if i change the second where close 'email_confirm' to lets say 'password'
then this problem i am writing about does not appear and no records are displayed. Pretty weird.
All this fields exist in a database and on html form.

$this->db->where('username', $this->input->post('username'));
$this->db->where('email_confirm', $this->input->post('email_confirm'));
$query = $this->db->get('users');

if ($query->num_rows() > 0) {
foreach ($query->result() as $row) {
echo $row->ID . ' ' .$row->username . ' ' . $row->email_confirm;
}
}