CVE-2014-125063 (published 2023-01-07T19:15Z)

A vulnerability was found in ada-l0velace Bid and classified as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is abd71140b8219fa8741d0d8a57ab27d5bfd34222. It is recommended to apply a patch to fix this issue. The identifier VDB-217625 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ada-l0velace/Bid
commit_details: repo_url: https://github.com/ada-l0velace/Bid
author: lolstorm
author_date: 2014-12-03 20:38:27+00:00
msg: sql injection problems solved
repository: repo_url: https://github.com/ada-l0velace/Bid
repo_name: ada-l0velace/Bid
description: Projecto de Bd
repo_language: PHP
owner: ada-l0velace
file_changes: filename: ajax_forms.js
change_type: ModificationType.MODIFY
diff: @@ -42,12 +42,14 @@ $(document).ready(function(){
 			data: values,
 			success: function(data){
 				try {
+					//alert(data);
 					var error = $(data).filter("#erro");
 					//var error = $(data).find('#erro'); use this if div is nested
-					alert(error.html());
+					if(error.html() != undefined)
+						alert(error.html());
 				}
 				catch(err) {
-					//console.log("Error not found");
+					console.log("Error not found");
 				}
 				populateDivTable("leilaoinscritos.php","leiloesincritos");
 				populateDivTable("leilaotop.php","leiloestop");

programming_language: JavaScript
filename: lance.php
change_type: ModificationType.MODIFY
diff: @@ -21,11 +21,18 @@
 	 $lance = test_input($_POST["lance"]);
 	 } 
 
-	$ultimolance_query="SELECT MAX(lance.valor) AS max_valor 
+	/*$ultimolance_query="SELECT MAX(lance.valor) AS max_valor 
 	                    FROM lance 
 	                    WHERE lance.leilao = $lid";
-	$ultimolance = $connection->query($ultimolance_query);
+	$ultimolance = $connection->query($ultimolance_query);*/
+	$ultimolance = $connection->prepare("SELECT MAX(lance.valor) AS max_valor 
+	                    FROM lance 
+	                    WHERE lance.leilao = :lid");
+	$ultimolance->bindParam(':lid', $lid);
+	$ultimolance->setFetchMode(PDO::FETCH_ASSOC);
+	$ultimolance->execute();
 	$teste = false;
+	$ultimolance = $ultimolance->fetchAll();
 	foreach($ultimolance as $row){
 		if($row['max_valor'] == ""){
 			$teste = true;
@@ -35,16 +42,19 @@
 		}
 
 	}
-	$ultimolance = $connection->query($ultimolance_query);
-
+	
+	//$ultimolance = $connection->query($ultimolance_query);
+	
 	if($teste == true){
 		$valorbase_query="SELECT valorbase AS min_valor 
 						  FROM leilaor, leilao 
-						  WHERE leilaor.lid = $lid 
+						  WHERE leilaor.lid = :lid 
 						  AND leilaor.dia = leilao.dia 
 						  AND leilaor.nrleilaonodia = leilao.nrleilaonodia 
 						  AND leilaor.nif = leilao.nif";
-		$valorbase = $connection->query($valorbase_query);
+		$valorbase = $connection->prepare($valorbase_query);
+		$valorbase->bindParam(':lid', $lid);
+		$valorbase->execute();
 		foreach($valorbase as $row){
 			$valor_min = $row["min_valor"];
 		}
@@ -59,12 +69,12 @@
 	if($valor_max < $lance and $valor_min <= $lance){
 		$lance_query="INSERT INTO lance(pessoa,leilao,valor) 
 					  VALUES ($nif,$lid,$lance)";
-		$result = $connection->query($lance_query);
-		
-		echo($lance_query);
+		$result = $connection->prepare($lance_query);
+		$error = $result->execute();
+		//echo($lance_query);
 		
-		if (!$result) {
-	 		echo("<div id='erro'> Não houve lance:($sql) </div>");
+		if (!$error) {
+	 		echo("<div id='erro'> Não houve lance:($error) </div>");
 		}
 	}else{
 		echo("<div id='erro'> O valor do lance é inválido </div>");

programming_language: PHP
filename: leilao.php
change_type: ModificationType.MODIFY
diff: @@ -24,9 +24,7 @@
 		exit();
 	}
 
-	//regista a pessoa no leilão. Exemplificativo apenas.....
-	$inscreve_query = "INSERT INTO concorrente (pessoa,leilao) 
-				       VALUES ($nif,$lid)";
+	
 	$data_now = date("y-m-d");
 
 	/*
@@ -37,9 +35,10 @@
 
 	/* PREPARED STATEMENTS */
 	$sqlDataLeilao = "SELECT * FROM leilaor 
-					  WHERE lid =" . $lid;
-	$resultado = $connection->query($sqlDataLeilao);
-
+					  WHERE lid =:lid";
+	$resultado = $connection->prepare($sqlDataLeilao);
+	$resultado->bindParam(':lid', $lid);
+	$error = $resultado->execute();
 	/*
 	echo("<p>");
 	echo($sqlDataLeilao);
@@ -47,8 +46,8 @@
 	*/
 
 
-	if (!$resultado) {
-		echo("<p> Erro na Query:($sql) </p>");
+	if (!$error) {
+		echo("<div id='erro'> Erro na Query:($sql) </div>");
 		exit();
 	}
 
@@ -71,10 +70,17 @@
 	echo("</p>");
 */
 	$datediff = strtotime($new_dia) - strtotime($data_now);
+
+	//regista a pessoa no leilão. Exemplificativo apenas.....
+	$inscreve_query = "INSERT INTO concorrente (pessoa,leilao) 
+				       VALUES (:nif,:lid)";
 	if($data_now <= $new_dia){
 		if($dia_abertura <= $data_now){
-			$inscreve = $connection->query($inscreve_query);
-			if (!$inscreve) {
+			$inscreve = $connection->prepare($inscreve_query);
+			$inscreve->bindParam(':nif', $nif);
+			$inscreve->bindParam(':lid', $lid);
+			$error = $inscreve->execute();
+			if (!$error) {
 			 	echo("<div id='erro'> Pessoa já se encontra registada neste leilão! </div>");
 				exit();
 			}

programming_language: PHP