CVE-2022-4933 (published 2023-03-20T05:15Z)

A vulnerability, which was classified as critical, has been found in ATM Consulting dolibarr_module_quicksupplierprice up to 1.1.6. Affected by this issue is the function upatePrice of the file script/interface.php. The manipulation leads to sql injection. The attack may be launched remotely. Upgrading to version 1.1.7 is able to address this issue. The patch is identified as ccad1e4282b0e393a32fcc852e82ec0e0af5446f. It is recommended to upgrade the affected component. VDB-223382 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/ATM-Consulting/dolibarr_module_quicksupplierprice
commit_details: repo_url: https://github.com/ATM-Consulting/dolibarr_module_quicksupplierprice
author: atm-florian
author_date: 2022-06-29 16:47:27+02:00
msg: FIX : `Interface.php` has fatal errors (invisible to user) due to SQL injection of empty input values - *29/06/2022* - 1.1.7
repository: repo_url: https://github.com/ATM-Consulting/dolibarr_module_quicksupplierprice
repo_name: ATM-Consulting/dolibarr_module_quicksupplierprice
description: Permet l'ajout rapide d'un prix pour un fournisseur directement depuis la commande fournisseur
repo_language: PHP
owner: ATM-Consulting
file_changes: filename: ChangeLog.md
change_type: ModificationType.MODIFY
diff: @@ -5,6 +5,8 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
+- FIX : `Interface.php` has fatal errors (invisible to user) due to SQL
+  injection of empty input values - *29/06/2022* - 1.1.7
 - FIX : Can't create more product prices if multidevise is enable - *01/06/2022* - 1.1.6
 - FIX : UX Changes between DOL 13.0 and 14.0 so we pull the qsp form under addline tpl - *02/05/2022* - 1.1.5
 - FIX : tvatx must not be converted to int, because it can have decimals and specific tva code - *30/03/2022* - 1.1.4

programming_language: Markdown
filename: modquicksupplierprice.class.php
change_type: ModificationType.MODIFY
diff: @@ -58,7 +58,7 @@ class modquicksupplierprice extends DolibarrModules
 		// Module description, used if translation string 'ModuleXXXDesc' not found (where XXX is value of numeric property 'numero' of module)
 		$this->description = "Description of module quicksupplierprice";
 		// Possible values for version are: 'development', 'experimental', 'dolibarr' or version
-		$this->version = '1.1.6';
+		$this->version = '1.1.7';
 		// Key used in llx_const table to save module status enabled/disabled (where MYMODULE is value of property name of module in uppercase)
 		$this->const_name = 'MAIN_MODULE_'.strtoupper($this->name);
 		// Where to store the module in setup page (0=common,1=interface,2=others,3=very specific)

programming_language: PHP
filename: interface.php
change_type: ModificationType.MODIFY
diff: @@ -118,6 +118,11 @@
     function upatePrice($id_prod, $fk_soc, $unitprice, $qte, $ref_search, $price, $ref, $tvatx){
         global $db, $user;
 
+		if ($price === '' || $unitprice === '') {
+			print json_encode(array('retour' => 0, 'error' => 'prix non renseigné'));
+			return;
+		}
+
         ob_start();
 
         // Clean vat code
@@ -128,16 +133,21 @@
         }
 
         // On vérifie si la ligne de tarif n'existe pas déjà pour ce fournisseur
-        $sql = "SELECT rowid FROM ".MAIN_DB_PREFIX."product_fournisseur_price WHERE fk_product=" . $id_prod;
-        $sql .= " AND fk_soc=" . $fk_soc;
-        $sql .= " AND unitprice=" . $unitprice;
-        $sql .= " AND quantity=" . $qte;
+		$sql = 'SELECT rowid FROM ' . MAIN_DB_PREFIX . 'product_fournisseur_price'
+			. ' WHERE fk_product=' . intval($id_prod)
+			. ' AND fk_soc=' . intval($fk_soc)
+			. ' AND unitprice=' . floatval($unitprice)
+			. ' AND quantity=' . intval($qte);
         if (!empty($vat_src_code)) {
-        	$sql .= " AND default_vat_code='" . $vat_src_code."'";
+        	$sql .= ' AND default_vat_code="' . $db->escape($vat_src_code).'"';
         }
 
 
         $resq = $db->query($sql);
+		if (!$resq) {
+			print json_encode(array('retour' => 0, 'error' => $db->lasterror()));
+			return;
+		}
 
         if($resq->num_rows !== 0){ // s'il existe, on renvoie l'id de cet ligne prix
             $obj = $db->fetch_object($resq);

programming_language: PHP