CVE-2014-125032 (published 2023-01-02T08:15Z)

A vulnerability was found in porpeeranut go-with-me. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file module/frontend/add.php. The manipulation leads to sql injection. The identifier of the patch is b92451e4f9e85e26cf493c95ea0a69e354c35df9. It is recommended to apply a patch to fix this issue. The identifier VDB-217177 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/porpeeranut/go-with-me
commit_details: repo_url: https://github.com/porpeeranut/go-with-me
author: bongtrop
author_date: 2014-12-08 13:40:29+07:00
msg: Fix sql injection in add.php file
repository: repo_url: https://github.com/porpeeranut/go-with-me
repo_name: porpeeranut/go-with-me
description: CPE342 Database Project
repo_language: PHP
owner: porpeeranut
file_changes: filename: add.php
change_type: ModificationType.MODIFY
diff: @@ -61,10 +61,10 @@ if ($table_name=="REGISTER") {
 }
 else if ($table_name=="PHOTO") {
   $caotion = clean($_POST["caption"]);
-  $owner = $m_id;
-  $loc_id = $_POST["loc_id"];
-  $timing_id = $_POST["timing_id"];
-  $pos_id = $_POST["pos_id"];
+  $owner = intval($m_id);
+  $loc_id = intval($_POST["loc_id"]);
+  $timing_id = intval($_POST["timing_id"]);
+  $pos_id = intval($_POST["pos_id"]);
 
   $sql = "insert into PHOTO values (member_seq.nextval, '$caption', $owner, $loc_id, $timing_id, $pos_id, systimestamp)";
   $stid = oci_parse($db_conn, $sql);
@@ -128,8 +128,8 @@ else if ($table_name=="PHOTO") {
   }
 }
 else if ($table_name=="COMMENT") {
-  $msg = $_POST["msg"];
-  $p_id = $_POST["p_id"];
+  $msg = clean($_POST["msg"]);
+  $p_id = intval($_POST["p_id"]);
 
   $sql = "insert into COMMENT_PHOTO values (comment_photo_seq.nextval, $m_id, $p_id, '$msg', systimestamp)";
   $stid = oci_parse($db_conn, $sql);
@@ -144,7 +144,7 @@ else if ($table_name=="COMMENT") {
   }
 }
 else if ($table_name=="LIKE") {
-  $p_id = $_POST["p_id"];
+  $p_id = intval($_POST["p_id"]);
   $sql = "insert into LIKE_PHOTO values ($m_id, $p_id, systimestamp)";
   $stid = oci_parse($db_conn, $sql);
   $r = oci_execute($stid);
@@ -158,8 +158,8 @@ else if ($table_name=="LIKE") {
   }
 }
 else if ($table_name=="MESSAGE") {
-  $to = $_POST["to"];
-  $msg = $_POST["msg"];
+  $to = intval($_POST["to"]);
+  $msg = clean($_POST["msg"]);
   $sql = "insert into MESSAGE values (message.nextval, $m_id, $to, msg, systimestamp)";
   $stid = oci_parse($db_conn, $sql);
   $r = oci_execute($stid);

programming_language: PHP