CVE-2020-21665 (published 2020-11-17T15:15Z)

In fastadmin V1.0.0.20191212_beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/karsonzhang/fastadmin
commit_details: repo_url: https://github.com/karsonzhang/fastadmin
author: Karson
author_date: 2019-12-27 12:09:20+08:00
msg: 修复邮箱验证码错误
修复排序表名安全检测
修复Selectpage编辑时分页大小错误
repository: repo_url: https://github.com/karsonzhang/fastadmin
repo_name: karsonzhang/fastadmin
description: 基于 ThinkPHP5 和 Bootstrap 的极速后台开发框架，一键生成 CRUD，自动生成控制器、模型、视图、JS、语言包、菜单、回收站。
repo_language: JavaScript
owner: karsonzhang
file_changes: filename: Ajax.php
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,7 @@ use think\Cache;
 use think\Config;
 use think\Db;
 use think\Lang;
+use think\Validate;
 
 /**
  * Ajax异步请求接口
@@ -155,6 +156,9 @@ class Ajax extends Backend
         $field = $this->request->post("field");
         //操作的数据表
         $table = $this->request->post("table");
+        if (!Validate::is($table, "alphaDash")) {
+            $this->error();
+        }
         //主键
         $pk = $this->request->post("pk");
         //排序的方式
@@ -214,16 +218,19 @@ class Ajax extends Backend
             case 'content':
                 rmdirs(CACHE_PATH, false);
                 Cache::clear();
-                if ($type == 'content')
+                if ($type == 'content') {
                     break;
+                }
             case 'template':
                 rmdirs(TEMP_PATH, false);
-                if ($type == 'template')
+                if ($type == 'template') {
                     break;
+                }
             case 'addons':
                 Service::refresh();
-                if ($type == 'addons')
+                if ($type == 'addons') {
                     break;
+                }
         }
 
         \think\Hook::listen("wipecache_after");

programming_language: PHP
filename: Backend.php
change_type: ModificationType.MODIFY
diff: @@ -451,6 +451,7 @@ class Backend extends Controller
         //如果有primaryvalue,说明当前是初始化传值
         if ($primaryvalue !== null) {
             $where = [$primarykey => ['in', $primaryvalue]];
+            $pagesize = null;
         } else {
             $where = function ($query) use ($word, $andor, $field, $searchfield, $custom) {
                 $logic = $andor == 'AND' ? '&' : '|';

programming_language: PHP
filename: User.php
change_type: ModificationType.MODIFY
diff: @@ -119,7 +119,7 @@ class User extends Frontend
                 if ($captchaType == 'mobile') {
                     $captchaResult = Sms::check($mobile, $captcha, 'register');
                 } elseif ($captchaType == 'email') {
-                    $captchaResult = Ems::check($mobile, $captcha, 'register');
+                    $captchaResult = Ems::check($email, $captcha, 'register');
                 } elseif ($captchaType == 'wechat') {
                     $captchaResult = WechatCaptcha::check($captcha, 'register');
                 } elseif ($captchaType == 'text') {

programming_language: PHP