Vulnerability: Benjamin BALET Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php.
Vulnerability ID: CVE-2022-34132
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/bbalet/jorani
Published: 2022-06-28
File: application/controllers/Leaves.php
Commit message: BF:Prevent SQL injection fix #369
Commit author: Benjamin BALET

Vulnerable version (before fix):
 public function validate() {         header("Content-Type: application/json");         $id = $this->input->post('id', TRUE);         $type = $this->input->post('type', TRUE);         //The above parameters could cause an SQL injection vulnerability due to the non standard         //SQL query in leave_model::detectOverlappingLeaves         $date = $this->input->post('startdate', TRUE);         $d = DateTime::createFromFormat('Y-m-d', $date);         $startdate = ($d && $d->format('Y-m-d') === $date)?$date:'1970-01-01';         $date = $this->input->post('enddate', TRUE);         $d = DateTime::createFromFormat('Y-m-d', $date);         $enddate = ($d && $d->format('Y-m-d') === $date)?$date:'1970-01-01';         $startdatetype = $this->input->post('startdatetype', TRUE);     //Mandatory field checked by frontend         $enddatetype = $this->input->post('enddatetype', TRUE);       //Mandatory field checked by frontend         $leave_id = $this->input->post('leave_id', TRUE);

Fixed version (after fix):
 public function validate() {         header("Content-Type: application/json");         $id = $this->input->post('id', TRUE);         $type = $this->input->post('type', TRUE);         $date = $this->input->post('startdate', TRUE);         $d = DateTime::createFromFormat('Y-m-d', $date);         $startdate = ($d && $d->format('Y-m-d') === $date)?$date:'1970-01-01';         $startdate = preg_replace("([^0-9-])", "", $startdate);         $date = $this->input->post('enddate', TRUE);         $d = DateTime::createFromFormat('Y-m-d', $date);         $enddate = ($d && $d->format('Y-m-d') === $date)?$date:'1970-01-01';         $enddate = preg_replace("([^0-9-])", "", $enddate);         $startdatetype = $this->input->post('startdatetype', TRUE);     //Mandatory field checked by frontend         $enddatetype = $this->input->post('enddatetype', TRUE);       //Mandatory field checked by frontend         $leave_id = $this->input->post('leave_id', TRUE);

Patch:
patch: @@ -820,14 +820,14 @@ public function validate() {
         header("Content-Type: application/json");
         $id = $this->input->post('id', TRUE);
         $type = $this->input->post('type', TRUE);
-        //The above parameters could cause an SQL injection vulnerability due to the non standard
-        //SQL query in leave_model::detectOverlappingLeaves
         $date = $this->input->post('startdate', TRUE);
         $d = DateTime::createFromFormat('Y-m-d', $date);
         $startdate = ($d && $d->format('Y-m-d') === $date)?$date:'1970-01-01';
+        $startdate = preg_replace("([^0-9-])", "", $startdate);
         $date = $this->input->post('enddate', TRUE);
         $d = DateTime::createFromFormat('Y-m-d', $date);
         $enddate = ($d && $d->format('Y-m-d') === $date)?$date:'1970-01-01';
+        $enddate = preg_replace("([^0-9-])", "", $enddate);
         $startdatetype = $this->input->post('startdatetype', TRUE);     //Mandatory field checked by frontend
         $enddatetype = $this->input->post('enddatetype', TRUE);       //Mandatory field checked by frontend
         $leave_id = $this->input->post('leave_id', TRUE);
path: application/controllers/Leaves.php