Vulnerability: Chamilo LMS version 1.11.8 contains a main/inc/lib/CoursesAndSessionsCatalog.class.php SQL injection, allowing users with access to the sessions catalogue (which may optionally be made public) to extract and/or modify database information.
Vulnerability ID: CVE-2018-20329
CWE: CWE-89
Severity score: 4.9
Project: https://github.com/chamilo/chamilo-lms
Published: 2018-12-21
File: main/inc/lib/CoursesAndSessionsCatalog.class.php
Commit message: Security: Fix SQL injection and likely future similar issues
Commit author: Yannick Warnier

Vulnerable version (before fix):
 public static function getLimitFilterFromArray($limit)     {         $limitFilter = '';         if (!empty($limit) && is_array($limit)) {             $limitStart = isset($limit['start']) ? $limit['start'] : 0;             $limitLength = isset($limit['length']) ? $limit['length'] : 12;             $limitFilter = 'LIMIT '.$limitStart.', '.$limitLength;         }  public static function search_courses($search_term, $limit, $justVisible = false      * @param array  $limit      *      * @return array The session list      */     public static function browseSessions($date = null, $limit = [])     {         $em = Database::getManager();         $urlId = api_get_current_access_url_id();         $sql = "SELECT s.id FROM session s ";         $sql .= "             INNER JOIN access_url_rel_session ars public static function browseSessions($date = null, $limit = [])         }          if (!empty($limit)) {             $sql .= "LIMIT {$limit['start']}, {$limit['length']} ";         } 

Fixed version (after fix):
 public static function getLimitFilterFromArray($limit)     {         $limitFilter = '';         if (!empty($limit) && is_array($limit)) {             $limitStart = isset($limit['start']) ? (int) $limit['start'] : 0;             $limitLength = isset($limit['length']) ? (int) $limit['length'] : 12;             $limitFilter = 'LIMIT '.$limitStart.', '.$limitLength;         }  public static function search_courses($search_term, $limit, $justVisible = false      * @param array  $limit      *      * @return array The session list      * @throws Exception      */     public static function browseSessions($date = null, $limit = [])     {         $em = Database::getManager();         $urlId = api_get_current_access_url_id();         $date = Database::escape_string($date);         $sql = "SELECT s.id FROM session s ";         $sql .= "             INNER JOIN access_url_rel_session ars public static function browseSessions($date = null, $limit = [])         }          if (!empty($limit)) {             $limit['start'] = (int) $limit['start'];             $limit['length'] = (int) $limit['length'];             $sql .= "LIMIT {$limit['start']}, {$limit['length']} ";         } 

Patch:
patch: @@ -215,8 +215,8 @@ public static function getLimitFilterFromArray($limit)
     {
         $limitFilter = '';
         if (!empty($limit) && is_array($limit)) {
-            $limitStart = isset($limit['start']) ? $limit['start'] : 0;
-            $limitLength = isset($limit['length']) ? $limit['length'] : 12;
+            $limitStart = isset($limit['start']) ? (int) $limit['start'] : 0;
+            $limitLength = isset($limit['length']) ? (int) $limit['length'] : 12;
             $limitFilter = 'LIMIT '.$limitStart.', '.$limitLength;
         }
 
@@ -470,11 +470,13 @@ public static function search_courses($search_term, $limit, $justVisible = false
      * @param array  $limit
      *
      * @return array The session list
+     * @throws Exception
      */
     public static function browseSessions($date = null, $limit = [])
     {
         $em = Database::getManager();
         $urlId = api_get_current_access_url_id();
+        $date = Database::escape_string($date);
         $sql = "SELECT s.id FROM session s ";
         $sql .= "
             INNER JOIN access_url_rel_session ars
@@ -501,6 +503,8 @@ public static function browseSessions($date = null, $limit = [])
         }
 
         if (!empty($limit)) {
+            $limit['start'] = (int) $limit['start'];
+            $limit['length'] = (int) $limit['length'];
             $sql .= "LIMIT {$limit['start']}, {$limit['length']} ";
         }
path: main/inc/lib/CoursesAndSessionsCatalog.class.php