Vulnerability: SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request.
Vulnerability ID: CVE-2014-1608
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/mantisbt/mantisbt
Published: 2014-03-18
File: api/soap/mc_file_api.php
Commit message: Fix CVE-2014-1608: mc_issue_attachment_get SQL injection

Use of db_query() instead of db_query_bound() allowed SQL injection
attacks due to unsanitized use of parameters within the query when using
the SOAP API mc_issue_attachment_get.

This issue was reported by e-mail by Andrea Barisani from oCERT, on
behalf of Martin Herfurt <martin.herfurt@nruns.com>, a security
researcher at n.runs professionals GmbH, who discovered the issue
during an audit at a customer's site.

Fixes #16879

Signed-off-by: Damien Regad <dregad@mantisbt.org>

Conflicts:
	api/soap/mc_file_api.php
Commit author: Paul Richards

Vulnerable version (before fix):
 function mci_file_get( $p_file_id, $p_type, $p_user_id ) {  	# we handle the case where the file is attached to a bug 	# or attached to a project as a project doc. 	$query = ''; 	switch( $p_type ) { 		case 'bug': 			$t_bug_file_table = db_get_table( 'mantis_bug_file_table' ); 			$query = "SELECT * 				FROM $t_bug_file_table 				WHERE id='$p_file_id'"; 			break; 		case 'doc': 			$t_project_file_table = db_get_table( 'mantis_project_file_table' ); 			$query = "SELECT * 				FROM $t_project_file_table 				WHERE id='$p_file_id'"; 			break; 		default: 			return SoapObjectsFactory::newSoapFault( 'Server', 'Invalid file type '.$p_type. ' .' ); 	}  	$result = db_query( $query );  	if ( $result->EOF ) { 		return SoapObjectsFactory::newSoapFault( 'Client', 'Unable to find an attachment with type ' . $p_type. ' and id ' . $p_file_id . ' .' );

Fixed version (after fix):
 function mci_file_get( $p_file_id, $p_type, $p_user_id ) {  	# we handle the case where the file is attached to a bug 	# or attached to a project as a project doc. 	$t_query = ''; 	switch( $p_type ) { 		case 'bug': 			$t_bug_file_table = db_get_table( 'mantis_bug_file_table' ); 			$t_query = "SELECT * FROM $t_bug_file_table WHERE id=" . db_param(); 			break; 		case 'doc': 			$t_project_file_table = db_get_table( 'mantis_project_file_table' ); 			$t_query = "SELECT * FROM $t_project_file_table WHERE id=" . db_param(); 			break; 		default: 			return SoapObjectsFactory::newSoapFault( 'Server', 'Invalid file type '.$p_type. ' .' ); 	}  	$result = db_query_bound( $t_query, array( $p_file_id ) );  	if ( $result->EOF ) { 		return SoapObjectsFactory::newSoapFault( 'Client', 'Unable to find an attachment with type ' . $p_type. ' and id ' . $p_file_id . ' .' );

Patch:
patch: @@ -154,25 +154,21 @@ function mci_file_get( $p_file_id, $p_type, $p_user_id ) {
 
 	# we handle the case where the file is attached to a bug
 	# or attached to a project as a project doc.
-	$query = '';
+	$t_query = '';
 	switch( $p_type ) {
 		case 'bug':
 			$t_bug_file_table = db_get_table( 'mantis_bug_file_table' );
-			$query = "SELECT *
-				FROM $t_bug_file_table
-				WHERE id='$p_file_id'";
+			$t_query = "SELECT * FROM $t_bug_file_table WHERE id=" . db_param();
 			break;
 		case 'doc':
 			$t_project_file_table = db_get_table( 'mantis_project_file_table' );
-			$query = "SELECT *
-				FROM $t_project_file_table
-				WHERE id='$p_file_id'";
+			$t_query = "SELECT * FROM $t_project_file_table WHERE id=" . db_param();
 			break;
 		default:
 			return SoapObjectsFactory::newSoapFault( 'Server', 'Invalid file type '.$p_type. ' .' );
 	}
 
-	$result = db_query( $query );
+	$result = db_query_bound( $t_query, array( $p_file_id ) );
 
 	if ( $result->EOF ) {
 		return SoapObjectsFactory::newSoapFault( 'Client', 'Unable to find an attachment with type ' . $p_type. ' and id ' . $p_file_id . ' .' );
path: api/soap/mc_file_api.php