CVE-2014-3119 (published 2020-01-31T21:15Z)

Multiple SQL injection vulnerabilities in web2Project 3.1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search_string parameter in the contacts module to index.php or allow remote attackers to execute arbitrary SQL commands via the updatekey parameter to (2) do_updatecontact.php or (3) updatecontact.php.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/web2project/web2project
commit_details: repo_url: https://github.com/web2project/web2project
author: Keith Casey
author_date: 2014-04-30 15:06:08-05:00
msg: adding some more things to filter
repository: repo_url: https://github.com/web2project/web2project
repo_name: web2project/web2project
description: A web-based project management system featuring gantt charts, time logging, and an extendable module system.
repo_language: PHP
owner: web2project
file_changes: filename: main_functions.php
change_type: ModificationType.MODIFY
diff: @@ -197,7 +197,7 @@ function w2PgetParam(&$arr, $name, $def = null)
             $result  = $_result;
         } else {
             $_result = strip_tags($arr[$key]);
-            $result  = preg_replace("/<>'\"\[\]{}:;/", "", $_result);
+            $result  = preg_replace("/<>\`'\"\[\]{}():;/", "", $_result);
         }
     } else {
         $result = $def;

programming_language: PHP
repo_url: https://github.com/web2project/web2project
commit_details: repo_url: https://github.com/web2project/web2project
author: Keith Casey
author_date: 2014-04-30 15:17:57-05:00
msg: filtering the update key a bit better
repository: repo_url: https://github.com/web2project/web2project
repo_name: web2project/web2project
description: A web-based project management system featuring gantt charts, time logging, and an extendable module system.
repo_language: PHP
owner: web2project
file_changes: filename: do_updatecontact.php
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,7 @@ require_once W2P_BASE_DIR . '/includes/db_adodb.php';
 $AppUI = new w2p_Core_CAppUI();
 
 $updatekey = w2PgetParam($_POST, 'updatekey', 0);
+$updatekey = preg_replace("/[^A-Za-z0-9]/", "", $updatekey);
 $contact_id = (int) CContact::getContactByUpdatekey($updatekey);
 
 if (!$contact_id) {

programming_language: PHP
filename: updatecontact.php
change_type: ModificationType.MODIFY
diff: @@ -6,6 +6,7 @@ require_once W2P_BASE_DIR . '/includes/db_adodb.php';
 $AppUI = new w2p_Core_CAppUI();
 
 $updatekey = w2PgetParam($_GET, 'updatekey', 0);
+$updatekey = preg_replace("/[^A-Za-z0-9]/", "", $updatekey);
 $contact_id = CContact::getContactByUpdatekey($updatekey);
 
 $company_id = intval(w2PgetParam($_REQUEST, 'company_id', 0));

programming_language: PHP