Vulnerability: USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search terms provided by the user were not sanitized and were used directly to construct a sql statement. The only users permitted to search are site admins. Users are advised to upgrade as soon as possible. There are not workarounds for this issue.
Vulnerability ID: CVE-2022-21644
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/Aaron-Junker/USOC
Published: 2022-01-04
File: admin/pages/usersearch.php
Commit message: Update usersearch.php
Commit author: Aaron Junker

Vulnerable version (before fix):
 <!DOCTYPE html> <html lang="<?php echo $U->getSetting("site.lang"); ?>" dir="ltr">     <head>         <style>             tbody > tr > th {                 font-weight: normal;             }         </style>         <meta charset="utf-8">         <title><?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.user.search"); ?></title>     </head>     <body>         <a href="javascript:window.close()"><?php echo $U->getLang("admin.exit"); ?></a>         <p><?php echo $U->getLang("admin.user.search.intro"); ?></p>         <form>             <label for="Name"><?php echo $U->getLang("admin.user.field.username"); ?>:</label><br />             <input type="text" name="Name" /><br />             <label for="Mail"><?php echo $U->getLang("admin.user.field.mail"); ?>:</label><br />             <input type="mail" name="Mail" /><br />             <input type="hidden" name="URL" value="usersearch" />             <input type="submit" value="<?php echo $U->getLang("admin.user.search.action"); ?>" />         </form>         <?php             if(isset($_GET["Name"])){                 if($_GET["Name"] !== ""){                     $sql = "SELECT * FROM User WHERE Username='".$_GET["Name"]."';";                     $db_erg = mysqli_query($U->db_link, $sql);                 }             }             if(isset($_GET["Mail"])){                 if($_GET["Mail"] !== ""){                     $sql = "SELECT * FROM User WHERE Mail='".$_GET["Mail"]."';";                     $db_erg = mysqli_query($U->db_link, $sql);                 }             }             if(isset($_GET["Mail"]) || isset($_GET["Name"])){                 $userhere = False;                 while($row = mysqli_fetch_array($db_erg, MYSQLI_ASSOC)){                     $userhere = True;         ?>                     <h4><?php echo str_replace("%a",$row["Username"],$U->getLang("admin.user.search.title")); ?></h4>                     <table>                         <tbody>                             <tr>                                 <th>                                     Id:                                 </th>                                 <th>                                     <?php echo $row["Id"]; ?>                                 </th>                             </tr>                             <tr>                                 <th>                                     <?php echo $U->getLang("admin.user.field.mail"); ?>:                                 </th>                                 <th>                                     <?php echo $row["Mail"]; ?>                                 </th>                             </tr>                             <tr>                                 <th>                                     <?php echo $U->getLang("admin.user.field.admin"); ?>                                 </th>                                 <th>                                     <?php echo $row["Type"]; ?>                                 </th>                             </tr>                             <tr>                                 <th>                                     <?php echo $U->getLang("admin.user.field.blocked"); ?>                                 </th>                                 <th>                                     <?php echo $row["blocked"]; ?>                                 </th>                             </tr>                         </tbody>                     </table>         <?php                 }                 if(!$userhere&&$_GET["Mail"] !== ""){                     echo str_replace("%a", $U->getLang("admin.user.field.mail"), str_replace("%b", $_GET["Mail"], $U->getLang("admin.user.notFound.property")));                 }                 if(!$userhere&&$_GET["Name"] !== ""){                     echo str_replace("%a", $U->getLang("admin.user.field.username"), str_replace("%b", $_GET["Name"], $U->getLang("admin.user.notFound.property")));                 }             }         ?>     </body> </html>\ No newline at end of file

Fixed version (after fix):
 <?php     if($U->userHasPermission("Backend", "User","Search")){ ?>     <!DOCTYPE html>     <html lang="<?php echo $U->getSetting("site.lang"); ?>" dir="ltr">         <head>             <style>                 tbody > tr > th {                     font-weight: normal;                 }             </style>             <meta charset="utf-8">             <title><?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.user.search"); ?></title>         </head>         <body>             <a href="javascript:window.close()"><?php echo $U->getLang("admin.exit"); ?></a>             <p><?php echo $U->getLang("admin.user.search.intro"); ?></p>             <form>                 <label for="Name"><?php echo $U->getLang("admin.user.field.username"); ?>:</label><br />                 <input type="text" name="Name" /><br />                 <label for="Mail"><?php echo $U->getLang("admin.user.field.mail"); ?>:</label><br />                 <input type="mail" name="Mail" /><br />                 <input type="hidden" name="URL" value="usersearch" />                 <input type="submit" value="<?php echo $U->getLang("admin.user.search.action"); ?>" />             </form>             <?php                 if(isset($_GET["Name"])){                     if($_GET["Name"] !== ""){                         $sql = "SELECT * FROM User WHERE Username='".mysqli::real_escape_string($_GET["Name"])."';";                         $dbRes = mysqli_query($U->db_link, $sql);                     }                 }                 if(isset($_GET["Mail"])){                     if($_GET["Mail"] !== ""){                         $sql = "SELECT * FROM User WHERE Mail='".mysqli::real_escape_string($_GET["Mail"])."';";                         $dbRes = mysqli_query($U->db_link, $sql);                     }                 }                 if(isset($_GET["Id"])){                     if($_GET["Id"] !== ""){                         $sql = "SELECT * FROM User WHERE Id='".mysqli::real_escape_string($_GET["Id"])."';";                         $dbRes = mysqli_query($U->db_link, $sql);                     }                 }                 if(isset($_GET["Mail"]) || isset($_GET["Name"]) || isset($_GET["Id"])){                     $userhere = False;                     while($row = mysqli_fetch_array($dbRes, MYSQLI_ASSOC)){                         $userhere = True;             ?>                         <h4><?php echo str_replace("%a",$row["Username"],$U->getLang("admin.user.search.title")); ?></h4>                         <table>                             <tbody>                                 <tr>                                     <th>                                         Id:                                     </th>                                     <th>                                         <?php echo $row["Id"]; ?>                                     </th>                                 </tr>                                 <tr>                                     <th>                                         <?php echo $U->getLang("admin.user.field.mail"); ?>:                                     </th>                                     <th>                                         <?php echo $row["Mail"]; ?>                                     </th>                                 </tr>                                 <tr>                                     <th>                                         <?php echo $U->getLang("admin.user.field.permissionlevel"); ?>                                     </th>                                     <th>                                         <?php echo $U->getPermissionName($row["Type"]); ?>                                     </th>                                 </tr>                                 <tr>                                     <th>                                         <?php echo $U->getLang("admin.user.field.blocked"); ?>                                     </th>                                     <th>                                         <?php echo $row["blocked"]==0?$U->getLang("admin.no"):$U->getLang("admin.yes"); ?>                                     </th>                                 </tr>                             </tbody>                         </table>             <?php                     }                     if(!$userhere&&isset($_GET["Mail"])&&$_GET["Mail"]!==""){                         echo str_replace("%a", $U->getLang("admin.user.field.mail"), str_replace("%b", $_GET["Mail"], $U->getLang("admin.user.notFound.property")));                     }                     if(!$userhere&&isset($_GET["Name"])&&$_GET["Name"]!==""){                         echo str_replace("%a", $U->getLang("admin.user.field.username"), str_replace("%b", $_GET["Name"], $U->getLang("admin.user.notFound.property")));                     }                     if(!$userhere&&isset($_GET["Id"])){                         echo str_replace("%a", $U->getLang("admin.user.field.id"), str_replace("%b", $_GET["Id"], $U->getLang("admin.user.notFound.property")));                     }                 }             ?>         </body>     </html> <?php   }else{ ?>   <!DOCTYPE html>   <html lang="<?php echo $U->getSetting("site.lang"); ?>" dir="ltr">     <head>       <meta charset="utf-8">       <title><?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.settings"); ?></title>     </head>     <body>         <a href="javascript:window.close()"><?php echo $U->getLang("admin.exit"); ?></a>       <p><?php echo $U->getLang("rights.error"); ?></p>     </body>\ No newline at end of file   </html> <?php   } ?>

Patch:
patch: @@ -1,89 +1,118 @@
-<!DOCTYPE html>
-<html lang="<?php echo $U->getSetting("site.lang"); ?>" dir="ltr">
-    <head>
-        <style>
-            tbody > tr > th {
-                font-weight: normal;
-            }
-        </style>
-        <meta charset="utf-8">
-        <title><?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.user.search"); ?></title>
-    </head>
-    <body>
-        <a href="javascript:window.close()"><?php echo $U->getLang("admin.exit"); ?></a>
-        <p><?php echo $U->getLang("admin.user.search.intro"); ?></p>
-        <form>
-            <label for="Name"><?php echo $U->getLang("admin.user.field.username"); ?>:</label><br />
-            <input type="text" name="Name" /><br />
-            <label for="Mail"><?php echo $U->getLang("admin.user.field.mail"); ?>:</label><br />
-            <input type="mail" name="Mail" /><br />
-            <input type="hidden" name="URL" value="usersearch" />
-            <input type="submit" value="<?php echo $U->getLang("admin.user.search.action"); ?>" />
-        </form>
-        <?php
-            if(isset($_GET["Name"])){
-                if($_GET["Name"] !== ""){
-                    $sql = "SELECT * FROM User WHERE Username='".$_GET["Name"]."';";
-                    $db_erg = mysqli_query($U->db_link, $sql);
+<?php
+    if($U->userHasPermission("Backend", "User","Search")){
+?>
+    <!DOCTYPE html>
+    <html lang="<?php echo $U->getSetting("site.lang"); ?>" dir="ltr">
+        <head>
+            <style>
+                tbody > tr > th {
+                    font-weight: normal;
                 }
-            }
-            if(isset($_GET["Mail"])){
-                if($_GET["Mail"] !== ""){
-                    $sql = "SELECT * FROM User WHERE Mail='".$_GET["Mail"]."';";
-                    $db_erg = mysqli_query($U->db_link, $sql);
+            </style>
+            <meta charset="utf-8">
+            <title><?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.user.search"); ?></title>
+        </head>
+        <body>
+            <a href="javascript:window.close()"><?php echo $U->getLang("admin.exit"); ?></a>
+            <p><?php echo $U->getLang("admin.user.search.intro"); ?></p>
+            <form>
+                <label for="Name"><?php echo $U->getLang("admin.user.field.username"); ?>:</label><br />
+                <input type="text" name="Name" /><br />
+                <label for="Mail"><?php echo $U->getLang("admin.user.field.mail"); ?>:</label><br />
+                <input type="mail" name="Mail" /><br />
+                <input type="hidden" name="URL" value="usersearch" />
+                <input type="submit" value="<?php echo $U->getLang("admin.user.search.action"); ?>" />
+            </form>
+            <?php
+                if(isset($_GET["Name"])){
+                    if($_GET["Name"] !== ""){
+                        $sql = "SELECT * FROM User WHERE Username='".mysqli::real_escape_string($_GET["Name"])."';";
+                        $dbRes = mysqli_query($U->db_link, $sql);
+                    }
                 }
-            }
-            if(isset($_GET["Mail"]) || isset($_GET["Name"])){
-                $userhere = False;
-                while($row = mysqli_fetch_array($db_erg, MYSQLI_ASSOC)){
-                    $userhere = True;
-        ?>
-                    <h4><?php echo str_replace("%a",$row["Username"],$U->getLang("admin.user.search.title")); ?></h4>
-                    <table>
-                        <tbody>
-                            <tr>
-                                <th>
-                                    Id:
-                                </th>
-                                <th>
-                                    <?php echo $row["Id"]; ?>
-                                </th>
-                            </tr>
-                            <tr>
-                                <th>
-                                    <?php echo $U->getLang("admin.user.field.mail"); ?>:
-                                </th>
-                                <th>
-                                    <?php echo $row["Mail"]; ?>
-                                </th>
-                            </tr>
-                            <tr>
-                                <th>
-                                    <?php echo $U->getLang("admin.user.field.admin"); ?>
-                                </th>
-                                <th>
-                                    <?php echo $row["Type"]; ?>
-                                </th>
-                            </tr>
-                            <tr>
-                                <th>
-                                    <?php echo $U->getLang("admin.user.field.blocked"); ?>
-                                </th>
-                                <th>
-                                    <?php echo $row["blocked"]; ?>
-                                </th>
-                            </tr>
-                        </tbody>
-                    </table>
-        <?php
+                if(isset($_GET["Mail"])){
+                    if($_GET["Mail"] !== ""){
+                        $sql = "SELECT * FROM User WHERE Mail='".mysqli::real_escape_string($_GET["Mail"])."';";
+                        $dbRes = mysqli_query($U->db_link, $sql);
+                    }
                 }
-                if(!$userhere&&$_GET["Mail"] !== ""){
-                    echo str_replace("%a", $U->getLang("admin.user.field.mail"), str_replace("%b", $_GET["Mail"], $U->getLang("admin.user.notFound.property")));
+                if(isset($_GET["Id"])){
+                    if($_GET["Id"] !== ""){
+                        $sql = "SELECT * FROM User WHERE Id='".mysqli::real_escape_string($_GET["Id"])."';";
+                        $dbRes = mysqli_query($U->db_link, $sql);
+                    }
                 }
-                if(!$userhere&&$_GET["Name"] !== ""){
-                    echo str_replace("%a", $U->getLang("admin.user.field.username"), str_replace("%b", $_GET["Name"], $U->getLang("admin.user.notFound.property")));
+                if(isset($_GET["Mail"]) || isset($_GET["Name"]) || isset($_GET["Id"])){
+                    $userhere = False;
+                    while($row = mysqli_fetch_array($dbRes, MYSQLI_ASSOC)){
+                        $userhere = True;
+            ?>
+                        <h4><?php echo str_replace("%a",$row["Username"],$U->getLang("admin.user.search.title")); ?></h4>
+                        <table>
+                            <tbody>
+                                <tr>
+                                    <th>
+                                        Id:
+                                    </th>
+                                    <th>
+                                        <?php echo $row["Id"]; ?>
+                                    </th>
+                                </tr>
+                                <tr>
+                                    <th>
+                                        <?php echo $U->getLang("admin.user.field.mail"); ?>:
+                                    </th>
+                                    <th>
+                                        <?php echo $row["Mail"]; ?>
+                                    </th>
+                                </tr>
+                                <tr>
+                                    <th>
+                                        <?php echo $U->getLang("admin.user.field.permissionlevel"); ?>
+                                    </th>
+                                    <th>
+                                        <?php echo $U->getPermissionName($row["Type"]); ?>
+                                    </th>
+                                </tr>
+                                <tr>
+                                    <th>
+                                        <?php echo $U->getLang("admin.user.field.blocked"); ?>
+                                    </th>
+                                    <th>
+                                        <?php echo $row["blocked"]==0?$U->getLang("admin.no"):$U->getLang("admin.yes"); ?>
+                                    </th>
+                                </tr>
+                            </tbody>
+                        </table>
+            <?php
+                    }
+                    if(!$userhere&&isset($_GET["Mail"])&&$_GET["Mail"]!==""){
+                        echo str_replace("%a", $U->getLang("admin.user.field.mail"), str_replace("%b", $_GET["Mail"], $U->getLang("admin.user.notFound.property")));
+                    }
+                    if(!$userhere&&isset($_GET["Name"])&&$_GET["Name"]!==""){
+                        echo str_replace("%a", $U->getLang("admin.user.field.username"), str_replace("%b", $_GET["Name"], $U->getLang("admin.user.notFound.property")));
+                    }
+                    if(!$userhere&&isset($_GET["Id"])){
+                        echo str_replace("%a", $U->getLang("admin.user.field.id"), str_replace("%b", $_GET["Id"], $U->getLang("admin.user.notFound.property")));
+                    }
                 }
-            }
-        ?>
+            ?>
+        </body>
+    </html>
+<?php
+  }else{
+?>
+  <!DOCTYPE html>
+  <html lang="<?php echo $U->getSetting("site.lang"); ?>" dir="ltr">
+    <head>
+      <meta charset="utf-8">
+      <title><?php echo $U->getLang("admin") ?> - <?php echo $U->getLang("admin.settings"); ?></title>
+    </head>
+    <body>
+        <a href="javascript:window.close()"><?php echo $U->getLang("admin.exit"); ?></a>
+      <p><?php echo $U->getLang("rights.error"); ?></p>
     </body>
-</html>
\ No newline at end of file
+  </html>
+<?php
+  }
+?>
path: admin/pages/usersearch.php