Vulnerability: install/installNewDB.php in TestLink through 1.9.16 allows remote attackers to conduct injection attacks by leveraging control over DB LOGIN NAMES data during installation to provide a long, crafted value.
Vulnerability ID: CVE-2018-7466
CWE: CWE-94
Severity score: 6.4
Project: https://github.com/TestLinkOpenSourceTRMS/testlink-code
Published: 2018-02-25
File: install/installNewDB.php
Commit message: Limit DB LOGIN NAMES length to avoid some kind of injection
Commit author: Francisco Mancardi

Vulnerable version (before fix):
 $db_server = trim($_SESSION['databasehost']); $db_server = preg_replace($san,'',$db_server);  $db_admin_name = trim($_SESSION['databaseloginname']); $db_admin_name = preg_replace($san,'',$db_admin_name);  $db_admin_pass = trim($_SESSION['databaseloginpassword']); $db_admin_pass = preg_replace($san,'',$db_admin_pass);  $db_type = trim($_SESSION['databasetype']); $db_type = preg_replace($san,'',$db_type);  $tl_db_login = trim($_SESSION['tl_loginname']); $tl_db_login = preg_replace($san,'',$tl_db_login);  $tl_db_passwd = trim($_SESSION['tl_loginpassword']); $tl_db_passwd = preg_replace($san,'',$tl_db_passwd);    $sql_create_schema = array(); $sql_create_schema[] = "sql/{$db_type}/testlink_create_tables.sql";

Fixed version (after fix):
 $db_server = trim($_SESSION['databasehost']); $db_server = preg_replace($san,'',$db_server);  $db_admin_pass = trim($_SESSION['databaseloginpassword']); $db_admin_pass = preg_replace($san,'',$db_admin_pass);  $db_type = trim($_SESSION['databasetype']); $db_type = preg_replace($san,'',$db_type);  $tl_db_passwd = trim($_SESSION['tl_loginpassword']); $tl_db_passwd = preg_replace($san,'',$tl_db_passwd);   // will limit length to avoi some kind of injection // Choice: 32  $tl_db_login = trim($_SESSION['tl_loginname']); $tl_db_login = substr(preg_replace($san,'',$tl_db_login),0,32);  $db_admin_name = trim($_SESSION['databaseloginname']); $db_admin_name = substr(preg_replace($san,'',$db_admin_name),0,32);    $sql_create_schema = array(); $sql_create_schema[] = "sql/{$db_type}/testlink_create_tables.sql";

Patch:
patch: @@ -63,22 +63,25 @@
 $db_server = trim($_SESSION['databasehost']);
 $db_server = preg_replace($san,'',$db_server);
 
-$db_admin_name = trim($_SESSION['databaseloginname']);
-$db_admin_name = preg_replace($san,'',$db_admin_name);
-
 $db_admin_pass = trim($_SESSION['databaseloginpassword']);
 $db_admin_pass = preg_replace($san,'',$db_admin_pass);
 
 $db_type = trim($_SESSION['databasetype']);
 $db_type = preg_replace($san,'',$db_type);
 
-$tl_db_login = trim($_SESSION['tl_loginname']);
-$tl_db_login = preg_replace($san,'',$tl_db_login);
-
 $tl_db_passwd = trim($_SESSION['tl_loginpassword']);
 $tl_db_passwd = preg_replace($san,'',$tl_db_passwd);
 
 
+// will limit length to avoi some kind of injection
+// Choice: 32 
+$tl_db_login = trim($_SESSION['tl_loginname']);
+$tl_db_login = substr(preg_replace($san,'',$tl_db_login),0,32);
+
+$db_admin_name = trim($_SESSION['databaseloginname']);
+$db_admin_name = substr(preg_replace($san,'',$db_admin_name),0,32);
+
+
 
 $sql_create_schema = array();
 $sql_create_schema[] = "sql/{$db_type}/testlink_create_tables.sql";
path: install/installNewDB.php