CVE-2023-52082 (published 2023-12-28T16:16Z)

Lychee is a free photo-management tool.  Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe.  The patch is provided on version 5.0.2.  To work around this issue, disable SQL EXPLAIN logging.\n

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/LycheeOrg/Lychee
commit_details: repo_url: https://github.com/LycheeOrg/Lychee
author: Benoît Viguier
author_date: 2023-12-28 16:15:36+01:00
msg: Fix Injection + v5.0.2 (#2123)
repository: repo_url: https://github.com/LycheeOrg/Lychee
repo_name: LycheeOrg/Lychee
description: A great looking and easy-to-use photo-management-system you can run on your server, to manage and share photos.
repo_language: PHP
owner: LycheeOrg
file_changes: filename: AppServiceProvider.php
change_type: ModificationType.MODIFY
diff: @@ -223,7 +223,7 @@ class AppServiceProvider extends ServiceProvider
 
 		$sql_with_bindings = Str::replaceArray('?', $bindings, $query->sql);
 
-		$explain = DB::select('EXPLAIN ' . $sql_with_bindings);
+		$explain = DB::select('EXPLAIN ' . $query->sql, $query->bindings);
 		$renderer = new ArrayToTextTable();
 		$renderer->setIgnoredKeys(['possible_keys', 'key_len', 'ref']);
 

programming_language: PHP
filename: 2023_12_28_144906_bump_version050002.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,26 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class() extends Migration {
+	/**
+	 * Run the migrations.
+	 *
+	 * @return void
+	 */
+	public function up(): void
+	{
+		DB::table('configs')->where('key', 'version')->update(['value' => '050002']);
+	}
+
+	/**
+	 * Reverse the migrations.
+	 *
+	 * @return void
+	 */
+	public function down(): void
+	{
+		DB::table('configs')->where('key', 'version')->update(['value' => '050001']);
+	}
+};

programming_language: PHP
filename: share-with.blade.php
change_type: ModificationType.MODIFY
diff: @@ -96,10 +96,10 @@
                                 @foreach ($this->userList as $result)
                                     <li class="border-b border-neutral-700 cursor-pointer transition-all ease-in-out duration-300
 							hover:bg-gradient-to-b hover:from-primary-500 hover:to-primary-600 hover:text-text-main-0"
-                                        wire:click="select('{{ $result['id'] }}','{{ $result['username'] }}')">
+                                        wire:click="select('{{ $result['id'] }}',@js($result['username']))">
                                         <a class="px-1 py-1 flex items-center"
                                             @if ($loop->last) @keydown.tab="isSearchUserOpen = false" @endif>
-                                            <span class="ml-4 text-left">{{ $result['username'] }}</span>
+                                            <span class="ml-4 text-left">{{ ($result['username']) }}</span>
                                         </a>
                                     </li>
                                 @endforeach

programming_language: PHP
filename: version.md
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-5.0.1
\ No newline at end of file
+5.0.2
\ No newline at end of file

programming_language: SQL