Vulnerability: The comments API in application/libraries/api/MY_Comments_Api_Object.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call.
Vulnerability ID: CVE-2012-3474
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/ushahidi/Ushahidi_Web
Published: 2012-08-12
File: application/libraries/api/MY_Comments_Api_Object.php
Commit message: Hide sensitive commenter details from comments API #650
Commit author: Robbie Mackay

Vulnerable version (before fix):
 private function _get_comment_list($where, $limit = '')         $json = array();         $json_item = array();          $this->query = "SELECT * FROM comment $where $limit";                  $items = $this->db->query($this->query);  private function _get_comment_list($where, $limit = '')                 $xml->writeElement('user_id',$list_item->user_id);                 $xml->writeElement('comment_author',                         $list_item->comment_author);                 $xml->writeElement('comment_email',                         $list_item->comment_email);                 $xml->writeElement('comment_description',                         $list_item->comment_description);                 $xml->writeElement('comment_ip',$list_item->comment_ip);                 $xml->writeElement('comment_active',                         $list_item->comment_active);                 $xml->writeElement('comment_date',$list_item->comment_date);                                      $xml->endElement(); // comment             } private function _get_comment_by_report_id($id) 			$incident_comments = array(); 			if ($id) 			{ 				$this->query = "SELECT id, incident_id, comment_author, comment_email, "; 				$this->query .= "comment_description,comment_date "; 				$this->query .= "FROM ".$this->table_prefix."`comment`" ; 				$this->query .= " WHERE `incident_id` = ".$this->db->escape_str($id)." AND `comment_active` = '1' "; 				$this->query .= "AND `comment_spam` = '0' ORDER BY `comment_date` ASC"; private function _get_comment_by_checkin_id($id) 			$checkin_comments = array(); 			if ($id) 			{ 				$this->query = "SELECT id, checkin_id, comment_author, comment_email, "; 				$this->query .= "comment_description,comment_date "; 				$this->query .= "FROM ".$this->table_prefix."`comment`" ; 				$this->query .= " WHERE `checkin_id` = ".$this->db->escape_str($id)." AND `comment_active` = '1' "; 				$this->query .= "AND `comment_spam` = '0' ORDER BY `comment_date` ASC";

Fixed version (after fix):
 private function _get_comment_list($where, $limit = '')         $json = array();         $json_item = array();          $this->query = "SELECT id, incident_id, comment_author, comment_description, comment_date, user_id FROM comment $where $limit";                  $items = $this->db->query($this->query);  private function _get_comment_list($where, $limit = '')                 $xml->writeElement('user_id',$list_item->user_id);                 $xml->writeElement('comment_author',                         $list_item->comment_author);                 $xml->writeElement('comment_description',                         $list_item->comment_description);                $xml->writeElement('comment_date',$list_item->comment_date);                                      $xml->endElement(); // comment             } private function _get_comment_by_report_id($id) 			$incident_comments = array(); 			if ($id) 			{ 				$this->query = "SELECT id, incident_id, comment_author, "; 				$this->query .= "comment_description, comment_date "; 				$this->query .= "FROM ".$this->table_prefix."`comment`" ; 				$this->query .= " WHERE `incident_id` = ".$this->db->escape_str($id)." AND `comment_active` = '1' "; 				$this->query .= "AND `comment_spam` = '0' ORDER BY `comment_date` ASC"; private function _get_comment_by_checkin_id($id) 			$checkin_comments = array(); 			if ($id) 			{ 				$this->query = "SELECT id, checkin_id, comment_author, "; 				$this->query .= "comment_description, comment_date "; 				$this->query .= "FROM ".$this->table_prefix."`comment`" ; 				$this->query .= " WHERE `checkin_id` = ".$this->db->escape_str($id)." AND `comment_active` = '1' "; 				$this->query .= "AND `comment_spam` = '0' ORDER BY `comment_date` ASC";

Patch:
patch: @@ -187,7 +187,7 @@ private function _get_comment_list($where, $limit = '')
         $json = array();
         $json_item = array();
 
-        $this->query = "SELECT * FROM comment $where $limit";
+        $this->query = "SELECT id, incident_id, comment_author, comment_description, comment_date, user_id FROM comment $where $limit";
         
         $items = $this->db->query($this->query);
 
@@ -225,14 +225,9 @@ private function _get_comment_list($where, $limit = '')
                 $xml->writeElement('user_id',$list_item->user_id);
                 $xml->writeElement('comment_author',
                         $list_item->comment_author);
-                $xml->writeElement('comment_email',
-                        $list_item->comment_email);
                 $xml->writeElement('comment_description',
                         $list_item->comment_description);
-                $xml->writeElement('comment_ip',$list_item->comment_ip);
-                $xml->writeElement('comment_active',
-                        $list_item->comment_active);
-                $xml->writeElement('comment_date',$list_item->comment_date);
+               $xml->writeElement('comment_date',$list_item->comment_date);
                     
                 $xml->endElement(); // comment
             }
@@ -802,8 +797,8 @@ private function _get_comment_by_report_id($id)
 			$incident_comments = array();
 			if ($id)
 			{
-				$this->query = "SELECT id, incident_id, comment_author, comment_email, ";
-				$this->query .= "comment_description,comment_date ";
+				$this->query = "SELECT id, incident_id, comment_author, ";
+				$this->query .= "comment_description, comment_date ";
 				$this->query .= "FROM ".$this->table_prefix."`comment`" ;
 				$this->query .= " WHERE `incident_id` = ".$this->db->escape_str($id)." AND `comment_active` = '1' ";
 				$this->query .= "AND `comment_spam` = '0' ORDER BY `comment_date` ASC";
@@ -877,8 +872,8 @@ private function _get_comment_by_checkin_id($id)
 			$checkin_comments = array();
 			if ($id)
 			{
-				$this->query = "SELECT id, checkin_id, comment_author, comment_email, ";
-				$this->query .= "comment_description,comment_date ";
+				$this->query = "SELECT id, checkin_id, comment_author, ";
+				$this->query .= "comment_description, comment_date ";
 				$this->query .= "FROM ".$this->table_prefix."`comment`" ;
 				$this->query .= " WHERE `checkin_id` = ".$this->db->escape_str($id)." AND `comment_active` = '1' ";
 				$this->query .= "AND `comment_spam` = '0' ORDER BY `comment_date` ASC";
path: application/libraries/api/MY_Comments_Api_Object.php