CVE-2023-31714 (published 2023-08-30T22:15Z)

Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/waqaskanju/Chitor-CMS
commit_details: repo_url: https://github.com/waqaskanju/Chitor-CMS
author: waqas ahmad
author_date: 2023-04-16 23:57:21+05:00
msg: add real_escape_string function to sandbox validate file
repository: repo_url: https://github.com/waqaskanju/Chitor-CMS
repo_name: waqaskanju/School-Management-System
description: School Management System
repo_language: PHP
owner: waqaskanju
file_changes: filename: edit_school.php
change_type: ModificationType.MODIFY
diff: @@ -17,7 +17,7 @@ session_start();
 require_once 'sand_box.php';
 $link=$LINK;
 
-if ($SCHOOL_CHANGES=="0") {
+if ($SCHOOL_CHANGES!=1) {
     echo '<div class="bg-danger text-center"> Not allowed!! </div>';
     exit;
 }

programming_language: PHP
filename: edit_school_class.php
change_type: ModificationType.MODIFY
diff: @@ -19,7 +19,7 @@ $link=$LINK;
 $selected_class=$CLASS_NAME;
 $selected_school=$SCHOOL_NAME;
 
-if ($SCHOOL_CHANGES=="0") {
+if ($SCHOOL_CHANGES!=1) {
     echo '<div class="bg-danger text-center"> Not allowed!! </div>';
     exit;
 }

programming_language: PHP
filename: functions.php
change_type: ModificationType.MODIFY
diff: @@ -188,20 +188,6 @@ function redirection($sec,$url)
     header("refresh:$sec; url=$url");
 }
 
-/**
- * Validate Form Input;
- *
- * @param string $data Name of the class.
- *
- * @return string return clean data.
- */
-function Validate_input($data)
-{
-    $data = trim($data);
-    $data = stripslashes($data);
-    $data = htmlspecialchars($data);
-    return $data;
-}
 
 /**
  * Show Alert Message

programming_language: PHP
filename: new_code_test.php
change_type: ModificationType.MODIFY
diff: @@ -16,4 +16,13 @@
 
 require_once 'sand_box.php';
 $link=$LINK;
+
+
+
+echo $query = 'SELECT Name,Class FROM students_info WHERE Name=? AND Class=?';
+$result = mysqli_execute_query($link, $query, ['Abdullah','5th']);
+foreach ($result as $row) {
+    printf($row["Name"]. $row['Class']);
+    echo "<br>";
+}
 ?>

programming_language: PHP
filename: sand_box.php
change_type: ModificationType.MODIFY
diff: @@ -904,6 +904,25 @@ function Exam_footer($class,$fail,$pass,$total)
     </div>
     ";
 }
+
+
+/**
+ * Validate Form Input;
+ *
+ * @param string $data Name of the class.
+ *
+ * @return string return clean data.
+ */
+function Validate_input($data)
+{
+    
+    global $link;
+    $data = trim($data);
+    $data = stripslashes($data);
+    $data = htmlspecialchars($data);
+    mysqli_real_escape_string($link, $data);
+    return $data;
+}
 ?>
 
 

programming_language: PHP
filename: check_roll_no.php
change_type: ModificationType.MODIFY
diff: @@ -14,7 +14,7 @@
  **/
 session_start();
 require_once '../db_connection.php';
-require_once '../functions.php';
+require_once '../sand_box.php';
 $link=$LINK;
 
 

programming_language: PHP
filename: update_subject_marks.php
change_type: ModificationType.MODIFY
diff: @@ -41,7 +41,7 @@ if ($marks>100) {
 }
 $q="UPDATE marks SET $subject = $marks WHERE Roll_No=$roll_no";
 // Do this if lock=off, that means lock=0
-// Singel Marks changes=allow means 1.
+// Single Marks changes=allow means 1.
 if ($SINGLE_MARKS_CHANGES==1 && $update_Status==0) {
     $exe=mysqli_query($link, $q) or die('error'.mysqli_error($link));
     if ($exe) {

programming_language: PHP