CVE-2013-3524 (published 2013-05-10T21:55Z)

SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter.  NOTE: this was originally reported as a problem in phpVMS.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/DavidJClark/phpVMS-PopUpNews
commit_details: repo_url: https://github.com/DavidJClark/phpVMS-PopUpNews
author: DavidJClark
author_date: 2013-04-16 12:14:35-04:00
msg: Update to controller
repository: repo_url: https://github.com/DavidJClark/phpVMS-PopUpNews
repo_name: DavidJClark/phpVMS-PopUpNews
description: phpVMS Module To Display Quick News List On Pages
repo_language: PHP
owner: DavidJClark
file_changes: filename: PopUpNews.php
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,7 @@ class PopUpNews extends CodonModule
 {
     public function popupnewsitem($id) {
 
+                $id = intval($id);
                 if(!is_numeric($id)){header('Location: '.url('/'));}
         
                 $result = PopUpNewsData::popupnewsitem($id);
@@ -23,6 +24,7 @@ class PopUpNews extends CodonModule
 
     public function PopUpNewsList($howmany = 5)
     {
+        $howmany = intval($howmany);
         if(!is_numeric($howmany)){exit;}
         
         $res = PopUpNewsData::get_news_list($howmany);

programming_language: PHP
repo_url: https://github.com/DavidJClark/phpVMS-PopUpNews
commit_details: repo_url: https://github.com/DavidJClark/phpVMS-PopUpNews
author: DavidJClark
author_date: 2013-04-16 11:03:54-04:00
msg: Update due to SQL injection exploit
repository: repo_url: https://github.com/DavidJClark/phpVMS-PopUpNews
repo_name: DavidJClark/phpVMS-PopUpNews
description: phpVMS Module To Display Quick News List On Pages
repo_language: PHP
owner: DavidJClark
file_changes: filename: PopUpNewsData.class.php
change_type: ModificationType.MODIFY
diff: @@ -15,14 +15,14 @@ class PopUpNewsData extends CodonData
     {
         $query = 'SELECT *
                  FROM ' . TABLE_PREFIX .'news
-                 WHERE id=' . $id . ' ';
+                 WHERE id=' . DB::escape($id) . ' ';
 
         return DB::get_row($query);
     }
     
     public function get_news_list($howmany) {
         $sql = 'SELECT id, subject, body, postedby, UNIX_TIMESTAMP(postdate) AS postdate
-		FROM ' . TABLE_PREFIX .'news ORDER BY postdate DESC LIMIT '.$howmany;
+		FROM ' . TABLE_PREFIX .'news ORDER BY postdate DESC LIMIT '.DB::escape($howmany);
 
         return DB::get_results($sql);
     }

programming_language: PHP
filename: PopUpNews.php
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,8 @@ class PopUpNews extends CodonModule
 {
     public function popupnewsitem($id) {
 
+                if(!is_numeric($id)){header('Location: '.url('/'));}
+        
                 $result = PopUpNewsData::popupnewsitem($id);
                 Template::Set('item', $result);
                 Template::Show('popupnews/popupnews_item.tpl');
@@ -21,6 +23,8 @@ class PopUpNews extends CodonModule
 
     public function PopUpNewsList($howmany = 5)
     {
+        if(!is_numeric($id)){exit;}
+        
         $res = PopUpNewsData::get_news_list($howmany);
 
         if(!$res)

programming_language: PHP