CVE-2022-43279 (published 2022-11-15T21:15Z)

LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php.

CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/LimeSurvey/LimeSurvey
commit_details: repo_url: https://github.com/LimeSurvey/LimeSurvey
author: Jessica Höck
author_date: 2021-06-08 16:53:52+02:00
msg: Fixed issue: Page Header and TopBar: Surveys - Survey Groups - Edit Survey Group
- Added TypeHints.
- Added green bar
- Added top bar
- Added shadow under top bar
- Renamed 'Close' to 'Back' Button
repository: repo_url: https://github.com/LimeSurvey/LimeSurvey
repo_name: LimeSurvey/LimeSurvey
description: The most popular FOSS online survey tool on the web.
repo_language: JavaScript
owner: LimeSurvey
file_changes: filename: SurveysGroupsController.php
change_type: ModificationType.MODIFY
diff: @@ -105,8 +105,9 @@ class SurveysGroupsController extends Survey_Common_Action
      *
      * @param integer $id the ID of the model to be updated
      * @return void
+     * @throws CHttpException
      */
-    public function update($id)
+    public function update(int $id)
     {
         $model = $this->loadModel($id);
         if (!empty(App()->getRequest()->getPost('SurveysGroups'))) {
@@ -151,12 +152,15 @@ class SurveysGroupsController extends Survey_Common_Action
             }
         }
 
+        $oSurveySearch = new Survey('search');
+        $oSurveySearch->gsid = $model->gsid;
+
         $aData = array(
             'model' => $model,
             'action' => App()->createUrl("admin/surveysgroups/sa/update", array('id' => $model->gsid, '#' => 'settingsForThisGroup')),
+            'pageTitle' => 'Update survey group: ' . $model->title,
         );
-        $oSurveySearch = new Survey('search');
-        $oSurveySearch->gsid = $model->gsid;
+
         $aData['oSurveySearch'] = $oSurveySearch;
         $aData['aRigths'] = array(
             'update' => $model->hasPermission('group', 'update'),
@@ -164,6 +168,21 @@ class SurveysGroupsController extends Survey_Common_Action
             'owner_id' => $model->owner_id == Yii::app()->user->id || Permission::model()->hasGlobalPermission('superadmin', 'read')
         );
 
+        $updateRightsForm = $aData['aRigths']['update'] ? 'surveys-groups-form' : null;
+
+        $aData['fullpagebar'] = [
+            'returnbutton' => [
+                'url' => 'surveyAdministration/listsurveys#surveygroups',
+                'text' => gT('Back'),
+            ],
+            'savebutton' => [
+                'form' => $updateRightsForm,
+            ],
+            'saveandclosebutton' => [
+                '$updateRightsForm',
+            ],
+        ];
+
         /* User for dropdown */
         $aUserIds = getUserList('onlyuidarray');
         if (!in_array($model->owner_id, $aUserIds)) {
@@ -178,6 +197,7 @@ class SurveysGroupsController extends Survey_Common_Action
         $oTemplateOptions           = new TemplateConfiguration();
         $oTemplateOptions->scenario = 'surveygroup';
         $aData['templateOptionsModel'] = $oTemplateOptions;
+
         // Page size
         if (Yii::app()->request->getParam('pageSize')) {
             Yii::app()->user->setState('pageSizeTemplateView', (int) Yii::app()->request->getParam('pageSize'));

programming_language: PHP
filename: update.php
change_type: ModificationType.MODIFY
diff: @@ -5,22 +5,6 @@
 
 <div class="col-lg-12 list-surveys">
 
-    <h3><?php eT('Update survey group: '); echo '<strong><em>'.CHtml::encode($model->title).'</strong></em>'; ?></h3>
-    <?php $this->renderPartial('super/fullpagebar_view', array(
-            'fullpagebar' => array(
-                'returnbutton'=>array(
-                    'url'=>'surveyAdministration/listsurveys#surveygroups',
-                    'text'=>gT('Close'),
-                ),
-                'savebutton' => array(
-                    'form' => $aRigths['update'] ? 'surveys-groups-form' : null,
-                ),
-                'saveandclosebutton' => array(
-                    'form' => $aRigths['update'] ? 'surveys-groups-form' : null,
-                )
-            )
-        )); ?>
-
     <div class="row">
         <ul class="nav nav-tabs" id="surveygrouptabsystem" role="tablist">
             <li class="active"><a href="#surveysInThisGroup"><?php eT('Surveys in this group'); ?></a></li>

programming_language: PHP