CVE-2021-4301 (published 2023-01-07T22:15Z)

A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. The patch is identified as 77dafb6a8cc1015f0777daeb5792f43beef77a9d. It is recommended to upgrade the affected component. VDB-217418 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/slackero/phpwcms
commit_details: repo_url: https://github.com/slackero/phpwcms
author: slackero
author_date: 2021-08-22 07:49:58+02:00
msg: Prevent $phpwcms['db_prepend'] from SQL injection
repository: repo_url: https://github.com/slackero/phpwcms
repo_name: slackero/phpwcms
description: Flexible, fast, powerful, customer, developer friendly web content management system and cms framework
repo_language: PHP
owner: slackero
file_changes: filename: dbcon.inc.php
change_type: ModificationType.MODIFY
diff: @@ -16,11 +16,7 @@ if (!defined('PHPWCMS_ROOT')) {
 }
 // ----------------------------------------------------------------
 
-// build the database table prepend part
-define ('DB_PREPEND', empty($GLOBALS['phpwcms']["db_prepend"]) ? '' : $GLOBALS['phpwcms']["db_prepend"].'_');
-
-// Log DB errors
-define ('DB_LOG_ERRORS', empty($GLOBALS['phpwcms']["db_errorlog"]) ? false : true);
+define('DB_LOG_ERRORS', empty($GLOBALS['phpwcms']["db_errorlog"]) ? false : true);
 
 // open the connection to MySQL database
 if(!empty($GLOBALS['phpwcms']["db_pers"]) && substr($GLOBALS['phpwcms']["db_host"], 0, 2) !== 'p:') {
@@ -37,6 +33,7 @@ if($is_mysql_error === false) {
     // for compatibility issues try to check for MySQL version and charset
     $GLOBALS['phpwcms']['db_version'] = _dbInitialize();
     define('PHPWCMS_DB_VERSION', $GLOBALS['phpwcms']['db_version']);
+    define('DB_PREPEND', empty($GLOBALS['phpwcms']["db_prepend"]) ? '' : mysqli_real_escape_string($GLOBALS['db'], $GLOBALS['phpwcms']["db_prepend"]) . '_');
 
 } elseif($is_mysql_error !== 'dbdown.php') {
 
@@ -45,11 +42,15 @@ if($is_mysql_error === false) {
 } else {
 
     define('PHPWCMS_DB_VERSION', $GLOBALS['phpwcms']['db_version']);
+    define('DB_PREPEND', empty($GLOBALS['phpwcms']["db_prepend"]) ? '' : aporeplace($GLOBALS['phpwcms']["db_prepend"]) . '_');
 
 }
 
 // deprecated function for escaping db items
 function aporeplace($value='') {
+    if (!$GLOBALS['db']) {
+        return str_replace(array("\\", "\x00", "\n", "\r", "'",  '"', "\x1a"), array("\\\\", "\\0", "\\n", "\\r", "\'", '\"', "\\Z"), $value);
+    }
     return mysqli_real_escape_string($GLOBALS['db'], $value);
 }
 

programming_language: PHP
filename: revision.php
change_type: ModificationType.MODIFY
diff: @@ -10,5 +10,5 @@
  **/
 
 define('PHPWCMS_VERSION', '1.9.27-dev');
-define('PHPWCMS_RELEASE_DATE', '2021/08/19');
+define('PHPWCMS_RELEASE_DATE', '2021/08/22');
 define('PHPWCMS_REVISION', '552');

programming_language: PHP
filename: setup.check.inc.php
change_type: ModificationType.MODIFY
diff: @@ -1,4 +1,17 @@
 <?php
+/**
+ * phpwcms content management system
+ *
+ * @author Oliver Georgi <og@phpwcms.org>
+ * @copyright Copyright (c) 2002-2021, Oliver Georgi
+ * @license http://opensource.org/licenses/GPL-2.0 GNU GPL-2
+ * @link http://www.phpwcms.org
+ *
+ **/
+
+if (!defined('PHP8')) {
+    die("You Cannot Access This Script Directly, Have a Nice Day.");
+}
 
 if(!empty($step)) {
 
@@ -85,7 +98,7 @@ if(!empty($step)) {
 
                     mysqli_free_result($result);
 
-                    if($result = mysqli_query($db, 'SELECT * FROM '. ($phpwcms["db_prepend"] ? $phpwcms["db_prepend"].'_' : '').'phpwcms_user')) {
+                    if($result = mysqli_query($db, 'SELECT * FROM '. ($phpwcms["db_prepend"] ? mysqli_real_escape_string($db, $phpwcms["db_prepend"]) . '_' : '') . 'phpwcms_user')) {
 
                         $_db_prepend_error = true;
                         mysqli_free_result($result);
@@ -128,7 +141,7 @@ if(!empty($step)) {
 
                             // now read and display sql queries
 
-                            $_db_prepend = ($phpwcms["db_prepend"] ? $phpwcms["db_prepend"].'_' : '');
+                            $_db_prepend = $phpwcms["db_prepend"] ? mysqli_real_escape_string($db, $phpwcms["db_prepend"]) . '_' : '';
 
                             $sql_data = read_textfile($DOCROOT . '/setup/default_sql/phpwcms_init.sql');
                             $sql_data = $sql_data . read_textfile($DOCROOT . '/setup/default_sql/phpwcms_inserts.sql');
@@ -219,8 +232,8 @@ if(!empty($step)) {
             } else {
                 mysqli_query($db, "SET SQL_MODE=NO_AUTO_VALUE_ON_ZERO,NO_ENGINE_SUBSTITUTION");
                 mysqli_query($db, "SET NAMES '".mysqli_real_escape_string($db, $phpwcms["charset"])."'");
-                $phpwcms["db_prepend"] = ($phpwcms["db_prepend"]) ? $phpwcms["db_prepend"]."_" : "";
-                $sql =  "INSERT INTO ".$phpwcms["db_prepend"]."phpwcms_user (usr_login, usr_pass, usr_email, ".
+                $_db_prepend = $phpwcms["db_prepend"] ? mysqli_real_escape_string($db, $phpwcms["db_prepend"]) . "_" : "";
+                $sql =  "INSERT INTO " . $_db_prepend . "phpwcms_user (usr_login, usr_pass, usr_email, ".
                         "usr_admin, usr_aktiv, usr_name, usr_fe, usr_wysiwyg ) VALUES ('".
                         mysqli_real_escape_string($db, $phpwcms["admin_user"])."', '".
                         mysqli_real_escape_string($db, md5($phpwcms["admin_pass"]))."', '".

programming_language: PHP
filename: step0.inc.php
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,10 @@
  *
  **/
 
+if (!defined('PHP8')) {
+    die("You Cannot Access This Script Directly, Have a Nice Day.");
+}
+
 $_SESSION['admin_set'] = false;
 $setup_recommend = true;
 

programming_language: PHP
filename: step1.inc.php
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,10 @@
  *
  **/
 
+if (!defined('PHP8')) {
+    die("You Cannot Access This Script Directly, Have a Nice Day.");
+}
+
 ?>
 <h1><span class="number">3.</span> MySQL database settings </h1>
 <?php
@@ -142,14 +146,14 @@ if(!empty($db_init)) {
     } elseif(isset($db_create_err) || !empty($db_no_create)) {
 
         // OK fine - initial tables were created without error
-        $_db_prepend = ($phpwcms["db_prepend"] ? $phpwcms["db_prepend"].'_' : '');
+        $_db_prepend = $phpwcms["db_prepend"] ? mysqli_real_escape_string($db, $phpwcms["db_prepend"]) . '_' : '';
         $check = _dbQuery("SHOW TABLES LIKE '".$_db_prepend."phpwcms_%'");
 
         if($check && count($check)) {
 
-            $sql_data               = false;
-            $db_sql                 = false;
-            $db_fine                = true;
+            $sql_data   = false;
+            $db_sql     = false;
+            $db_fine    = true;
 
 ?>
       <tr>
@@ -305,7 +309,7 @@ if(!empty($_SESSION['admin_set'])) {
 
     } else {
 
-        $_db_prepend = ($phpwcms["db_prepend"] ? $phpwcms["db_prepend"].'_' : '');
+        $_db_prepend = $phpwcms["db_prepend"] ? mysqli_real_escape_string($db, $phpwcms["db_prepend"]) . '_' : '';
 
         //show Info that admin info was saved
         //and also if stored in database

programming_language: PHP
filename: step2.inc.php
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,10 @@
  *
  **/
 
+if (!defined('PHP8')) {
+    die("You Cannot Access This Script Directly, Have a Nice Day.");
+}
+
 if ($err) {
     echo '<p class="error"><b>Check your admin user name and password!</b></p>';
 }

programming_language: PHP
filename: step3.inc.php
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,10 @@
  *
  **/
 
+if (!defined('PHP8')) {
+    die("You Cannot Access This Script Directly, Have a Nice Day.");
+}
+
 ?>
 <p class="title">phpwcms path settings </p>
 <p>Please check that any path value does NOT begin or end with a slash. I recommend

programming_language: PHP
filename: step4.inc.php
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,10 @@
  *
  **/
 
+if (!defined('PHP8')) {
+    die("You Cannot Access This Script Directly, Have a Nice Day.");
+}
+
 ?><p class="title">phpwcms content values</p>
 <form action="setup.php?step=4" method="post"><table border="0" cellpadding="0" cellspacing="0" summary="">
           <tr>

programming_language: PHP
filename: step5.inc.php
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,9 @@
  *
  **/
 
+if (!defined('PHP8')) {
+    die("You Cannot Access This Script Directly, Have a Nice Day.");
+}
 
 $_SERVER['DOCUMENT_ROOT'] = $phpwcms['DOC_ROOT'];
 $phpwcms["root"] = !empty($phpwcms["root"]) ? "/".$phpwcms["root"] : "";

programming_language: PHP