CVE-2010-10003 (published 2023-01-04T10:15Z)

A vulnerability classified as critical was found in gesellix titlelink on Joomla. Affected by this vulnerability is an unknown functionality of the file plugin_content_title.php. The manipulation of the argument phrase leads to sql injection. The patch is named b4604e523853965fa981a4e79aef4b554a535db0. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217351.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/gesellix/titlelink
commit_details: repo_url: https://github.com/gesellix/titlelink
author: Tobias Gesellchen
author_date: 2010-08-08 18:17:54+00:00
msg: [#20653] SQL Injection: $phrase is escaped now, yet most of the plugins have to be updated according to plugin_content_title.php


git-svn-id: http://joomlacode.org/svn/titlelink@27 de31ee7e-3f2c-0410-b67e-83f64df8b4ac
repository: repo_url: https://github.com/gesellix/titlelink
repo_name: gesellix/titlelink
description: Joomla! TitleLink plugin
repo_language: PHP
owner: gesellix
file_changes: filename: changelog.php
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,11 @@ defined( '_JEXEC' ) or die('Direct Access to this location is not allowed.');
 
 ?>
 
+2010-08-08:
+
+- [#20653] SQL Injection: $phrase is escaped now, yet most of the plugins have to be updated according to plugin_content_title.php
+
+
 2009-06-06:
 
 - [#16580] Exact Match as default or plugin option

programming_language: SQL
filename: titlelink.php
change_type: ModificationType.MODIFY
diff: @@ -592,10 +592,12 @@ class plgContentTitleLink extends JPlugin
 
   function getByPlugins($database, $plugins, $phrase, $partial_match)
   {
+    $phrase_escaped = $database->getEscaped($phrase, true);
+
     $count = count($plugins);
     for ($i = 0; $i < $count; $i++)
     {
-      $result = call_user_func($plugins[$i], $database, $phrase, $partial_match);
+      $result = call_user_func($plugins[$i], $database, $phrase_escaped, $partial_match);
 
       // magix number '2' is the amount of strings we need as result
       if (count($result) == 2)

programming_language: PHP
filename: titlelink.xml
change_type: ModificationType.MODIFY
diff: @@ -3,11 +3,11 @@
 	<name>Content - TitleLink</name>
 	<author>Tobias Gesellchen</author>
 	<creationDate>2008-06-03</creationDate>
-	<copyright>(C) 2005-2009 Tobias Gesellchen. All rights reserved.</copyright>
+	<copyright>(C) 2005-2010 Tobias Gesellchen. All rights reserved.</copyright>
 	<license>http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL</license>
 	<authorEmail>tobias@gesellix.de</authorEmail>
 	<authorUrl>www.gesellix.de</authorUrl>
-	<version>3.2.0 2009-06-06 stable</version>
+	<version>3.2.1 2010-08-08 stable</version>
   <description>DESCTITLELINK</description>
   <files>
     <filename plugin="titlelink">titlelink.php</filename>

programming_language: TeX
filename: plugin_content_title.php
change_type: ModificationType.MODIFY
diff: @@ -27,12 +27,18 @@ function plugin_contentTitle($database, $phrase, $partial_match = true)
 
   $where_clause = " WHERE a.state=1 ";
 
-  $where_variant = " AND a.alias " . (($partial_match) ? " LIKE '%$phrase%'" : "= '$phrase'");
+  $where_variant = " AND a.alias " .
+  				(($partial_match)
+  					? " LIKE ".$database->quote('%'.$phrase.'%', false)
+    				: "= ".$database->quote($phrase, false));
   $result = findContentInternal($database, $query.$where_clause.$where_variant, false);
 
   if ($result == null)
   {
-    $where_variant = " AND a.title " . (($partial_match) ? " LIKE '%$phrase%'" : "= '$phrase'");
+    $where_variant = " AND a.title " .
+  				(($partial_match)
+  					? " LIKE ".$database->quote('%'.$phrase.'%', false)
+  					: "= ".$database->quote($phrase, false));
   	$result = findContentInternal($database, $query.$where_clause.$where_variant, true);
   }
   

programming_language: PHP