Vulnerability: USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via register.php. In particular usernames, email addresses, and passwords provided by the user were not sanitized and were used directly to construct a sql statement. Users are advised to upgrade as soon as possible. There are not workarounds for this issue.
Vulnerability ID: CVE-2022-21643
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/Aaron-Junker/USOC
Published: 2022-01-04
File: login/register.php
Commit message: Update register.php
Commit author: Aaron Junker

Vulnerable version (before fix):
           if(preg_match('/^[a-z0-9A-Z.:,;]{8,25}$/',$_POST["P"])){             $register = True;             $sql = "SELECT * FROM User";             $db_erg = mysqli_query($U->db_link, $sql);             while ($row = mysqli_fetch_array($db_erg, MYSQLI_ASSOC))             {               //Checks if username or mail are in use               if(strtolower($row["Username"]) == strtolower($_POST["U"])||strtolower($row["Mail"])==strtolower($_POST["M"])){   if($register){     //Register succeeded:     //Register user     $sql = 'INSERT INTO User (Username, Mail, Password, Type) VALUES ('."'".$_POST["U"]."'".','."'".$_POST["M"]."'".','."'".password_hash($_POST["P"],PASSWORD_DEFAULT)."'".',0);';     if($db_erg = mysqli_query($U->db_link, $sql)){       //Database register is succeeded       echo $U->getLang("register.succeed");       header("Location: ".$USOC["DOMAIN"]);

Fixed version (after fix):
           if(preg_match('/^[a-z0-9A-Z.:,;]{8,25}$/',$_POST["P"])){             $register = True;             $sql = "SELECT * FROM User";             $dbRes = mysqli_query($U->db_link, $sql);             while ($row = mysqli_fetch_array($dbRes, MYSQLI_ASSOC))             {               //Checks if username or mail are in use               if(strtolower($row["Username"]) == strtolower($_POST["U"])||strtolower($row["Mail"])==strtolower($_POST["M"])){   if($register){     //Register succeeded:     //Register user     $sql = 'INSERT INTO User (Username, Mail, Password, Type) VALUES ('."'".mysqli::real_escape_string($_POST["U"])."'".','."'".mysqli::real_escape_string($_POST["M"])."'".','."'".password_hash(mysqli::real_escape_string($_POST["P"]),PASSWORD_DEFAULT)."'".','.$USOC["userRights"]["AfterRegistration"].');';     if($dbRes = mysqli_query($U->db_link, $sql)){       //Database register is succeeded       echo $U->getLang("register.succeed");       header("Location: ".$USOC["DOMAIN"]);

Patch:
patch: @@ -25,8 +25,8 @@
           if(preg_match('/^[a-z0-9A-Z.:,;]{8,25}$/',$_POST["P"])){
             $register = True;
             $sql = "SELECT * FROM User";
-            $db_erg = mysqli_query($U->db_link, $sql);
-            while ($row = mysqli_fetch_array($db_erg, MYSQLI_ASSOC))
+            $dbRes = mysqli_query($U->db_link, $sql);
+            while ($row = mysqli_fetch_array($dbRes, MYSQLI_ASSOC))
             {
               //Checks if username or mail are in use
               if(strtolower($row["Username"]) == strtolower($_POST["U"])||strtolower($row["Mail"])==strtolower($_POST["M"])){
@@ -57,8 +57,8 @@
   if($register){
     //Register succeeded:
     //Register user
-    $sql = 'INSERT INTO User (Username, Mail, Password, Type) VALUES ('."'".$_POST["U"]."'".','."'".$_POST["M"]."'".','."'".password_hash($_POST["P"],PASSWORD_DEFAULT)."'".',0);';
-    if($db_erg = mysqli_query($U->db_link, $sql)){
+    $sql = 'INSERT INTO User (Username, Mail, Password, Type) VALUES ('."'".mysqli::real_escape_string($_POST["U"])."'".','."'".mysqli::real_escape_string($_POST["M"])."'".','."'".password_hash(mysqli::real_escape_string($_POST["P"]),PASSWORD_DEFAULT)."'".','.$USOC["userRights"]["AfterRegistration"].');';
+    if($dbRes = mysqli_query($U->db_link, $sql)){
       //Database register is succeeded
       echo $U->getLang("register.succeed");
       header("Location: ".$USOC["DOMAIN"]);
path: login/register.php