CVE-2013-10012 (published 2023-01-16T11:15Z)

A vulnerability, which was classified as critical, was found in antonbolling clan7ups. Affected is an unknown function of the component Login/Session. The manipulation leads to sql injection. The name of the patch is 25afad571c488291033958d845830ba0a1710764. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218388.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/antonbolling/clan7ups
commit_details: repo_url: https://github.com/antonbolling/clan7ups
author: Ryan Berckmans
author_date: 2013-02-12 21:51:40-05:00
msg: this codebase is riddled with sql injection vulnerabilities; fix some of the key vulnerabilities in login/session code
repository: repo_url: https://github.com/antonbolling/clan7ups
repo_name: antonbolling/clan7ups
repo_language: Perl
owner: antonbolling
file_changes: filename: login.pl
change_type: ModificationType.MODIFY
diff: @@ -53,17 +53,17 @@ if ($sth->rows) {
 }
 
 #login is real, check the password
-$sth = $dbh->prepare("select id from users where name='$login' and pass=PASSWORD('$pass')");
-$sth->execute;
+my $login_sql = $dbh->prepare("select id from users where name=? and pass=PASSWORD(?)");
+$login_sql->execute($login,$pass);
 
-my $valid_login = $sth->rows;
-my ($uid) = $sth->fetchrow_array;
+my $valid_login = $login_sql->rows;
+my ($uid) = $login_sql->fetchrow_array;
 
 if ($valid_login) {
   # Login was valid, get the current time.
-  my $sth = $dbh->prepare("select unix_timestamp(now())");
-  $sth->execute;
-  my ($time) = $sth->fetchrow_array;
+  my $time_sql = $dbh->prepare("select unix_timestamp(now())");
+  $time_sql->execute;
+  my ($time) = $time_sql->fetchrow_array;
 
   my $magic = new_session($dbh, $uid);
   my $CGI_params = $q->Vars;

programming_language: Perl
filename: session.pl
change_type: ModificationType.MODIFY
diff: @@ -17,8 +17,10 @@ sub new_session {
   # Make sequence numbers random.
   my $magic = int rand(2147483648);
 
-  $dbh->do("update users set magic=$magic where id=$uid");
-  $dbh->do("update users set session_stamp=now() where id=$uid");
+  my $sql = $dbh->prepare("update users set magic=? where id=?");
+	$sql->execute($magic,$uid);
+  $sql = $dbh->prepare("update users set session_stamp=now() where id=?");
+	$sql->execute($uid);
 
   return $magic;
 }
@@ -34,8 +36,8 @@ sub get_session {
 
 #  print "<p>PASSED uid, magic: $uid, $cgi_magic</p>";
 
-  my $sth = $dbh->prepare("select magic, UNIX_TIMESTAMP(now())-UNIX_TIMESTAMP(session_stamp) as elapsed from users where id=$uid");
-  $sth->execute;
+  my $sth = $dbh->prepare("select magic, UNIX_TIMESTAMP(now())-UNIX_TIMESTAMP(session_stamp) as elapsed from users where id=?");
+  $sth->execute($uid);
   my ($db_magic, $elapsed) = $sth->fetchrow_array;
 
 #  print "<p>FOUND magic, elapsed: $db_magic, $elapsed</p>\n";
@@ -43,12 +45,9 @@ sub get_session {
   if (($db_magic == $cgi_magic) and ($elapsed < $session_timeout)) {
     # Set a new session timestamp, update magic.
     my $new_magic = int rand(2147483648);
-    $dbh->do("update users set session_stamp=now(), magic=$new_magic where id=$uid");
+    my $sql = $dbh->prepare("update users set session_stamp=now(), magic=? where id=?");
+		$sql->execute($new_magic,$uid);
 
-    # Put magic into cgi query.
-#    my $vars = $q->Vars;
-#    $vars->{'magic'} = $new_magic;
-    # Successfully continued session...
     return 1;
   }
   else {
@@ -63,8 +62,8 @@ sub get_access {
   my ($dbh, $q, $view_time) = @_;
   my $uid = cook_int($q->param('uid'));
 
-  my $sth = $dbh->prepare("select access from users where id=$uid");
-  $sth->execute;
+  my $sth = $dbh->prepare("select access from users where id=?");
+  $sth->execute($uid);
   my ($access) = $sth->fetchrow_array;
 
   return $access;
@@ -76,8 +75,8 @@ sub no_access {
   my $action = cook_word($q->param('action'));
 
   # Log it.
-  my $sth = $dbh->prepare("insert into log (user,action,cdata1) values($uid,'accessdenied','$action')");
-  $sth->execute;
+  my $sth = $dbh->prepare("insert into log (user,action,cdata1) values(?,'accessdenied','$action')");
+  $sth->execute($uid);
 
   # Notify the user.
   print <<EOT;
@@ -96,8 +95,8 @@ sub get_session_info {
   my $uid = cook_int($q->param('uid'));
   my $magic = cook_int($q->param('magic'));
 
-  my $sth = $dbh->prepare("select magic from users where id=$uid");
-  $sth->execute;
+  my $sth = $dbh->prepare("select magic from users where id=?");
+  $sth->execute($uid);
   my ($nextmagic) = $sth->fetchrow_array;
 
   return "<input type='hidden' name='uid' value='$uid'>\n<input type='hidden' name='magic' value='$nextmagic'>\n";

programming_language: Perl