leez/org.eff.donortrends — pull request #1 by micahflee (2013-05-20 18:45:04+00:00)
Title: $group_filter isn't getting sanitized before executing SQL

A bunch of queries get run with $group_filter in them that look like this:

SELECT cc.contact_id, MIN(cc.receive_date) AS receive_date FROM civicrm_contribution cc LEFT JOIN civicrm_group_contact on cc.contact_id = civicrm_group_contact.contact_id WHERE civicrm_group_contact.group_id = $group_filter GROUP BY contact_id HAVING receive_date >= %1 and receive_date < %2

If a user can control what's in $group_filter, they could take over the sql query and potentially gain total access to the data in the database.

This would only be exploitable by users with high permissions in the first place, and luckily it doesn't even appear to be exploitable at all because the form you made with buildQuickForm() seems to get validated automatically, making group_ids that aren't numbers cause a fatal error already, rather than forwarding them on to your sql.

All the same, it's better to always sanitize inputs instead of trusting the civicrm code that validates group_id earlier.