CVE-2019-20107 (published 2020-03-05T13:15Z)

Multiple SQL injection vulnerabilities in TestLink through 1.9.19 allows remote authenticated users to execute arbitrary SQL commands via the (1) tproject_id parameter to keywordsView.php; the (2) req_spec_id parameter to reqSpecCompareRevisions.php; the (3) requirement_id parameter to reqCompareVersions.php; the (4) build_id parameter to planUpdateTC.php; the (5) tplan_id parameter to newest_tcversions.php; the (6) tplan_id parameter to tcCreatedPerUserGUI.php; the (7) tcase_id parameter to tcAssign2Tplan.php; or the (8) testcase_id parameter to tcCompareVersions.php. Authentication is often easy to achieve: a guest account, that can execute this attack, can be created by anyone in the default configuration.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
commit_details: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
author: Francisco Mancardi
author_date: 2019-12-30 09:58:07+01:00
msg: fix: security #8829
repository: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
repo_name: TestLinkOpenSourceTRMS/testlink-code
description: TestLink Open Source Test & Requirement Management System
repo_language: PHP
owner: TestLinkOpenSourceTRMS
file_changes: filename: tcAssign2Tplan.php
change_type: ModificationType.MODIFY
diff: @@ -176,8 +176,17 @@ function init_args()
   $args = new stdClass();
   $args->tplan_id = isset($_REQUEST['tplan_id']) ? $_REQUEST['tplan_id'] : $_SESSION['testplanID'];
   $args->tproject_id = isset($_REQUEST['tproject_id']) ? $_REQUEST['tproject_id'] : $_SESSION['testprojectID'];
+  
+  $args->tproject_id = intval($args->tproject_id);
+  $args->tplan_id = intval($args->tplan_id);
+
+
   $args->tcase_id = isset($_REQUEST['tcase_id']) ? $_REQUEST['tcase_id'] : 0;
+  $args->tcase_id = intval($args->tcase_id);
+
   $args->tcversion_id = isset($_REQUEST['tcversion_id']) ? $_REQUEST['tcversion_id'] : 0;
+  $args->tcversion_id = intval($args->tcversion_id);
+
   return $args; 
 }
 

programming_language: PHP
repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
commit_details: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
author: Francisco Mancardi
author_date: 2019-12-30 09:51:24+01:00
msg: fix: security #8829
repository: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
repo_name: TestLinkOpenSourceTRMS/testlink-code
description: TestLink Open Source Test & Requirement Management System
repo_language: PHP
owner: TestLinkOpenSourceTRMS
file_changes: filename: reqCompareVersions.php
change_type: ModificationType.MODIFY
diff: @@ -247,11 +247,12 @@ function getCFDiff($cfields,&$reqMgr)
 function init_args() {
   $args = new stdClass();
 
-  $args->req_id = isset($_REQUEST['requirement_id']) ? $_REQUEST['requirement_id'] : 0;
+  $args->req_id = isset($_REQUEST['requirement_id']) ? intval($_REQUEST['requirement_id']) : 0;
+
   $args->compare_selected_versions = isset($_REQUEST['compare_selected_versions']);
   $args->left_item_id = isset($_REQUEST['left_item_id']) ? intval($_REQUEST['left_item_id']) : -1;
   $args->right_item_id = isset($_REQUEST['right_item_id']) ? intval($_REQUEST['right_item_id']) :  -1;
-    $args->tproject_id = isset($_SESSION['testprojectID']) ? $_SESSION['testprojectID'] : 0;
+    $args->tproject_id = isset($_SESSION['testprojectID']) ? intval($_SESSION['testprojectID']) : 0;
 
   $args->use_daisydiff = isset($_REQUEST['use_html_comp']);
 

programming_language: PHP
repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
commit_details: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
author: Francisco Mancardi
author_date: 2019-12-30 09:59:16+01:00
msg: fix: security #8829
repository: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
repo_name: TestLinkOpenSourceTRMS/testlink-code
description: TestLink Open Source Test & Requirement Management System
repo_language: PHP
owner: TestLinkOpenSourceTRMS
file_changes: filename: tcCompareVersions.php
change_type: ModificationType.MODIFY
diff: @@ -85,7 +85,8 @@ function init_args()
 	
 
   $args->tcase_id = isset($_REQUEST['testcase_id']) ? $_REQUEST['testcase_id'] : 0;
-
+  $args->tcase_id = intval($args->tcase_id);
+ 
   $key2set = array('compare_selected_versions' => 0,'version_left' => '','version_right' => '');
   foreach($key2set as $tk => $value)
   {

programming_language: PHP
repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
commit_details: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
author: Francisco Mancardi
author_date: 2019-12-30 09:49:37+01:00
msg: fix: security #8829
repository: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
repo_name: TestLinkOpenSourceTRMS/testlink-code
description: TestLink Open Source Test & Requirement Management System
repo_language: PHP
owner: TestLinkOpenSourceTRMS
file_changes: filename: reqSpecCompareRevisions.php
change_type: ModificationType.MODIFY
diff: @@ -229,14 +229,15 @@ function init_args()
 	
 
 	$args = new stdClass();
-	$args->req_spec_id = isset($_REQUEST['req_spec_id']) ? $_REQUEST['req_spec_id'] : 0;
+	$args->req_spec_id = isset($_REQUEST['req_spec_id']) ? intval($_REQUEST['req_spec_id']) : 0;
 	$args->doCompare = isset($_REQUEST['doCompare']) ? true : false;
 	$args->left_item_id = isset($_REQUEST['left_item_id']) ? intval($_REQUEST['left_item_id']) : -1;
 	$args->right_item_id = isset($_REQUEST['right_item_id']) ? intval($_REQUEST['right_item_id']) :  -1;
-	$args->tproject_id = isset($_SESSION['testprojectID']) ? $_SESSION['testprojectID'] : 0;
+	$args->tproject_id = isset($_SESSION['testprojectID']) ? intval($_SESSION['testprojectID']) : 0;
 	$args->useDaisyDiff = (isset($_REQUEST['diff_method']) && ($_REQUEST['diff_method'] == 'htmlCompare')) ? 1 : 0;
 	
 
+
 	$diffEngineCfg = config_get("diffEngine");
 	$args->context = null;
 	if( !isset($_REQUEST['context_show_all'])) 

programming_language: PHP
repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
commit_details: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
author: Francisco Mancardi
author_date: 2019-12-30 09:54:11+01:00
msg: fix: security #8829
repository: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
repo_name: TestLinkOpenSourceTRMS/testlink-code
description: TestLink Open Source Test & Requirement Management System
repo_language: PHP
owner: TestLinkOpenSourceTRMS
file_changes: filename: newest_tcversions.php
change_type: ModificationType.MODIFY
diff: @@ -88,11 +88,12 @@ function init_args()
     
     $args = new stdClass();
     $args->user_id = $_SESSION['userID'];
-    $args->tproject_id = $_SESSION['testprojectID'];
+    $args->tproject_id = intval($_SESSION['testprojectID']);
     $args->tproject_name = $_SESSION['testprojectName'];
     
     $args->tplan_id = isset($_REQUEST['tplan_id']) ? $_REQUEST['tplan_id'] : $_SESSION['testplanID'];
-    
+    $args->tplan_id = intval($args->tplan_id);
+
     $args->id = isset($_REQUEST['id']) ? $_REQUEST['id'] : null;
     $args->version_id = isset($_REQUEST['version_id']) ? $_REQUEST['version_id'] : 0;
     $args->level = isset($_REQUEST['level']) ? $_REQUEST['level'] : null;

programming_language: PHP
filename: planUpdateTC.php
change_type: ModificationType.MODIFY
diff: @@ -114,7 +114,7 @@ function init_args(&$tplanMgr)
 {
     $_REQUEST = strings_stripSlashes($_REQUEST);
     $args = new stdClass();
-    $args->id = isset($_REQUEST['id']) ? $_REQUEST['id'] : null;
+    $args->id = isset($_REQUEST['id']) ? intval($_REQUEST['id']) : null;
     $args->level = isset($_REQUEST['level']) ? $_REQUEST['level'] : null;
     $args->doAction = isset($_REQUEST['doAction']) ? $_REQUEST['doAction'] : null;
 

programming_language: PHP
repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
commit_details: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
author: Francisco Mancardi
author_date: 2019-12-31 12:06:22+01:00
msg: fix: security #8829
repository: repo_url: https://github.com/TestLinkOpenSourceTRMS/testlink-code
repo_name: TestLinkOpenSourceTRMS/testlink-code
description: TestLink Open Source Test & Requirement Management System
repo_language: PHP
owner: TestLinkOpenSourceTRMS
file_changes: filename: tc_exec_unassign_all.php
change_type: ModificationType.MODIFY
diff: @@ -4,12 +4,7 @@
  * This script is distributed under the GNU General Public License 2 or later. 
  *
  * @package		TestLink
- * @author		Andreas Simon
- * @copyright	2005-2010, TestLink community 
- * @version		CVS: $Id: tc_exec_unassign_all.php,v 1.3 2010/07/26 19:00:57 asimon83 Exp $
- * @link		http://www.teamst.org/index.php
- *
- * @internal revisions:
+ * @copyright	2005-2019, TestLink community 
  * 
  */
 
@@ -69,11 +64,12 @@ function init_args() {
 	
 	$_REQUEST = strings_stripSlashes($_REQUEST);
 	
-	$args->build_id = isset($_REQUEST['build_id']) ? $_REQUEST['build_id'] : 0;
+	$args->build_id = isset($_REQUEST['build_id']) ? 
+	                  intval($_REQUEST['build_id']) : 0;
 	$args->confirmed = isset($_REQUEST['confirmed']) && $_REQUEST['confirmed'] == 'yes' ? true : false;
 	
 	$args->user_id = $_SESSION['userID'];
-	$args->testproject_id = $_SESSION['testprojectID'];
+	$args->testproject_id = intval($_SESSION['testprojectID']);
 	$args->testproject_name = $_SESSION['testprojectName'];
 	
 	$args->refreshTree = isset($_SESSION['setting_refresh_tree_on_action']) ?

programming_language: PHP
filename: testCasesWithCF.php
change_type: ModificationType.MODIFY
diff: @@ -8,8 +8,6 @@
  *
  * For a test plan, list test cases with Execution Custom Field Data
  *
- * @internal revisions
- * @since 1.9.7
  */
 require_once("../../config.inc.php");
 require_once("common.php");
@@ -142,21 +140,24 @@ $smarty->display($templateCfg->template_dir . $templateCfg->default_template);
  */
 function init_args(&$dbHandler)
 {
-    $argsObj = new stdClass();
+  $argsObj = new stdClass();
 	$argsObj->doIt = false;
-    $argsObj->showPlatforms = false;
-    $argsObj->tproject_id = isset($_SESSION['testprojectID']) ? $_SESSION['testprojectID'] : 0;
-    $argsObj->tproject_name = isset($_SESSION['testprojectName']) ? $_SESSION['testprojectName'] : '';
+  $argsObj->showPlatforms = false;
+  $argsObj->tproject_id = isset($_SESSION['testprojectID']) ? $_SESSION['testprojectID'] : 0;
+  $argsObj->tproject_id = intval($argsObj->tproject_id);
 
-    $argsObj->tplan_name = '';
-    $argsObj->tplan_id = isset($_REQUEST['tplan_id']) ? $_REQUEST['tplan_id'] : 0;
-    if($argsObj->tplan_id == 0)
-    {
-        $argsObj->tplan_id = isset($_SESSION['testplanID']) ? $_SESSION['testplanID'] : 0;
-    }
 
-    if($argsObj->tplan_id > 0)
-    {
+  $argsObj->tproject_name = isset($_SESSION['testprojectName']) ? $_SESSION['testprojectName'] : '';
+
+  $argsObj->tplan_name = '';
+  $argsObj->tplan_id = isset($_REQUEST['tplan_id']) ? $_REQUEST['tplan_id'] : 0;
+  $argsObj->tplan_id = intval($argsObj->tplan_id);
+
+  if ($argsObj->tplan_id == 0) {
+    $argsObj->tplan_id = isset($_SESSION['testplanID']) ? $_SESSION['testplanID'] : 0;
+  }
+
+  if($argsObj->tplan_id > 0) {
     	$tplan_mgr = new testplan($dbHandler);
         $tplan_info = $tplan_mgr->get_by_id($argsObj->tplan_id);
         $argsObj->tplan_name = $tplan_info['name'];
@@ -166,9 +167,9 @@ function init_args(&$dbHandler)
 		$getOpt = array('outputFormat' => 'map');
 		$argsObj->platforms = $tplan_mgr->getPlatforms($argsObj->tplan_id,$getOpt);
 		unset($tplan_mgr);
-    }
+  }
 
-    return $argsObj;
+  return $argsObj;
 }
 
 
@@ -310,5 +311,4 @@ function getColumnsDefinition($showPlatforms,$customFields,$platforms)
 function checkRights(&$db,&$user)
 {
 	return $user->hasRight($db,'testplan_metrics');
-}
-?>
\ No newline at end of file
+}
\ No newline at end of file

programming_language: PHP