CVE-2019-13578 (published 2019-08-15T16:15Z)

A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/impress-org/give
commit_details: repo_url: https://github.com/impress-org/give
author: Ravinder Kumar
author_date: 2019-07-11 17:58:17+05:30
msg: fix: allow orderby only for whitelist columns
repository: repo_url: https://github.com/impress-org/give
repo_name: impress-org/givewp
description: GiveWP - The #1 Donation Plugin for WordPress. Easily accept donations and fundraise using your WordPress website.
repo_language: PHP
owner: impress-org
file_changes: filename: class-give-donors-query.php
change_type: ModificationType.MODIFY
diff: @@ -466,6 +466,7 @@ class Give_Donors_Query {
 		foreach ( $ordersby as $orderby => $order ) {
 			if( ! array_key_exists( $orderby, $table_columns ) ) {
 				unset( $ordersby[$orderby] );
+				continue;
 			}
 
 			$ordersby[ esc_sql( $orderby ) ] = esc_sql( $order );

programming_language: PHP
repo_url: https://github.com/impress-org/give
commit_details: repo_url: https://github.com/impress-org/give
author: Ravinder Kumar
author_date: 2019-07-12 19:10:02+05:30
msg: chore: validate order param for payment query
repository: repo_url: https://github.com/impress-org/give
repo_name: impress-org/givewp
description: GiveWP - The #1 Donation Plugin for WordPress. Easily accept donations and fundraise using your WordPress website.
repo_language: PHP
owner: impress-org
file_changes: filename: class-payments-query.php
change_type: ModificationType.MODIFY
diff: @@ -157,6 +157,9 @@ class Give_Payments_Query extends Give_Stats {
 		// While set filters $args will get override and multiple get_payments call will not work.
 		$this->args = $this->_args;
 
+		// Whitelist order.
+		$this->args['order'] = in_array( strtoupper( $this->args['order'] ), array( 'ASC', 'DESC' ) ) ? $this->args['order'] : 'DESC' ;
+
 		$this->date_filter_pre();
 		$this->orderby();
 		$this->status();

programming_language: PHP
repo_url: https://github.com/impress-org/give
commit_details: repo_url: https://github.com/impress-org/give
author: Ravinder Kumar
author_date: 2019-07-12 21:25:59+05:30
msg: chore: validate orderby param for payment query
repository: repo_url: https://github.com/impress-org/give
repo_name: impress-org/givewp
description: GiveWP - The #1 Donation Plugin for WordPress. Easily accept donations and fundraise using your WordPress website.
repo_language: PHP
owner: impress-org
file_changes: filename: class-payments-query.php
change_type: ModificationType.MODIFY
diff: @@ -815,6 +815,26 @@ class Give_Payments_Query extends Give_Stats {
 	private function get_sql() {
 		global $wpdb;
 
+		$allowed_keys = array(
+			'post_name',
+			'post_author',
+			'post_date',
+			'post_title',
+			'post_status',
+			'post_modified',
+			'post_parent',
+			'post_type',
+			'menu_order',
+			'comment_count',
+		);
+
+		$this->args['orderby'] = 'post_parent__in';
+
+		// Whitelist orderby.
+		if( ! in_array( $this->args['orderby'], $allowed_keys ) ) {
+			$this->args['orderby'] = 'ID';
+		}
+
 		$where = "WHERE {$wpdb->posts}.post_type = 'give_payment'";
 		$where .= " AND {$wpdb->posts}.post_status IN ('" . implode( "','", $this->args['post_status'] ) . "')";
 

programming_language: PHP