CVE-2017-20169 (published 2023-01-13T21:15Z)

A vulnerability, which was classified as critical, has been found in GGGGGGGG ToN-MasterServer. Affected by this issue is some unknown functionality of the file public_html/irc_updater/svr_request_pub.php. The manipulation leads to sql injection. The patch is identified as 3a4c7e6d51bf95760820e3245e06c6e321a7168a. It is recommended to apply a patch to fix this issue. VDB-218306 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/GGGGGGGG/ToN-MasterServer
commit_details: repo_url: https://github.com/GGGGGGGG/ToN-MasterServer
author: Cedeqien
author_date: 2017-12-19 21:07:30-05:00
msg: protection against sql injections
repository: repo_url: https://github.com/GGGGGGGG/ToN-MasterServer
repo_name: GGGGGGGG/ToN-MasterServer
repo_language: PHP
owner: GGGGGGGG
file_changes: filename: config.php
change_type: ModificationType.MODIFY
diff: @@ -6,7 +6,6 @@ $config['db']['password'] = trim(file_get_contents('/var/www/masterserver1.tales
 $config['db']['database'] = "masterserver";
 $config['db']['patchesdb'] = "patches";
 $config['hash'] = "abcdefgh";
-$config['isProxy'] = True;
 $config['public_url'] = "s2.michaelk.ch.localhost";
 $patchesdbcon = NULL;
 $dbcon = NULL;

programming_language: PHP
filename: svr_request_pub.php
change_type: ModificationType.MODIFY
diff: @@ -30,25 +30,26 @@ function handle_get_online()
 /* Add a server */
 function handle_set_online()
 {
+	global $dbcon;
+
 	/* Sanitize input */
-	$ip = $_SERVER["REMOTE_ADDR"];
-	$port = intval(post_input("port"));
-	$num_conn = intval(post_input("num_conn"));
-	$max_conn = intval(post_input("num_max"));
-	$name = post_input("name");
-	$desc = post_input("desc");
-	$status = post_input("status");
-	$minkarma = post_input("minkarma");
-	$location = post_input("location");
-	$cgt = post_input("cgt");
-	$next_map = post_input("next_map");
-	$map = post_input("map");
-	$login = post_input("login");
-	$pass = post_input("pass");
-	$minlevel = intval(post_input("minlevel"));
-	$maxlevel = intval(post_input("maxlevel"));
+	$ip = mysqli_real_escape_string($dbcon, $_SERVER["REMOTE_ADDR"]);
+	$port = mysqli_real_escape_string($dbcon,intval(post_input("port")));
+	$num_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_conn")));
+	$max_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_max")));
+	$name = mysqli_real_escape_string($dbcon, post_input("name"));
+	$desc = mysqli_real_escape_string($dbcon, post_input("desc"));
+	$status = mysqli_real_escape_string($dbcon, post_input("status"));
+	$minkarma = mysqli_real_escape_string($dbcon, post_input("minkarma"));
+	$location = mysqli_real_escape_string($dbcon, post_input("location"));
+	$cgt = mysqli_real_escape_string($dbcon, post_input("cgt"));
+	$next_map = mysqli_real_escape_string($dbcon, post_input("next_map"));
+	$map = mysqli_real_escape_string($dbcon, post_input("map"));
+	$login = mysqli_real_escape_string($dbcon, post_input("login"));
+	$pass = mysqli_real_escape_string($dbcon, post_input("pass"));
+	$minlevel = mysqli_real_escape_string($dbcon, intval(post_input("minlevel")));
+	$maxlevel = mysqli_real_escape_string($dbcon, intval(post_input("maxlevel")));
 	/* authenticate server */
-	global $config;
 	$data = array();
 	$isOfficial = False;
 
@@ -75,7 +76,6 @@ function handle_set_online()
 			description = '$desc', minlevel = $minlevel, 
 			maxlevel = $maxlevel, updated = NOW(), online = 1";
 
-	global $dbcon;		
 	mysqli_query($dbcon, $query);
 
 
@@ -94,9 +94,10 @@ function handle_set_online()
 /* Save accounts on a server */
 function handle_set_online_ids()
 {
+	global $dbcon;
 	/* Update number of connections */
-	$num_conn = intval(post_input("num_conn"));
-	$login = post_input("login");
+	$num_conn = mysqli_real_escape_string($dbcon, intval(post_input("num_conn")));
+	$login = mysqli_real_escape_string($dbcon, post_input("login"));
 	$query = "
 		UPDATE servers SET
 			num_conn = $num_conn,
@@ -114,7 +115,7 @@ function handle_shutdown()
 	global $dbcon;
 
 	/* Remove server from list */
-	$id = intval(post_input("server_id"));
+	$id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
 	$query = "
 		UPDATE servers SET num_conn = 0, updated = NOW(), online = 0
 		WHERE
@@ -130,13 +131,13 @@ function handle_c_conn()
 {
 	global $dbcon;
 
-	$account_id = intval(post_input("account_id"));
-	$server_id = intval(post_input("server_id"));
-	$c_conn['account_id'] = post_input("account_id");
-	$c_conn['server_id'] = post_input("server_id");
-	$c_conn['num_conn'] = post_input("num_conn");
-	$c_conn['cookie'] = post_input("cookie");
-	$c_conn['ip'] = post_input("ip");
+	$account_id = mysqli_real_escape_string($dbcon, intval(post_input("account_id")));
+	$server_id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
+	$c_conn['account_id'] = mysqli_real_escape_string($dbcon, post_input("account_id"));
+	$c_conn['server_id'] = mysqli_real_escape_string($dbcon, post_input("server_id"));
+	$c_conn['num_conn'] = mysqli_real_escape_string($dbcon, post_input("num_conn"));
+	$c_conn['cookie'] = mysqli_real_escape_string($dbcon, post_input("cookie"));
+	$c_conn['ip'] = mysqli_real_escape_string($dbcon, post_input("ip"));
 
 	$cookie = $c_conn['cookie'];
 
@@ -161,6 +162,7 @@ function handle_c_conn()
 			server = {$server_id},
 			updated = NOW(),
 			online = 1";
+
 	db_query($query);
 
 	$query = "SELECT username from users where id = $account_id";
@@ -174,8 +176,10 @@ function handle_c_conn()
 /* User disconnects a server */
 function handle_c_disc() 
 {
-	$account_id = intval(post_input("account_id"));
-	$server_id = intval(post_input("server_id"));
+	global $dbcon;
+
+	$account_id = mysqli_real_escape_string($dbcon, intval(post_input("account_id")));
+	$server_id = mysqli_real_escape_string($dbcon, intval(post_input("server_id")));
 	
 	$query = "
 		UPDATE
@@ -197,12 +201,14 @@ function handle_c_disc()
 /* Server start game */
 function handle_auth()
 {
-	$a['login'] = post_input('login');
-	$a['pass'] = post_input('pass');
-	$a['type'] = post_input('type'); // = "reg"
-	$a['port'] = post_input('port');
-	$a['map'] = post_input('map');
-	$a['account_ids'] = $_POST['account_id'];
+	global $dbcon;
+
+	$a['login'] = mysqli_real_escape_string($dbcon, post_input('login'));
+	$a['pass'] = mysqli_real_escape_string($dbcon, post_input('pass'));
+	$a['type'] = mysqli_real_escape_string($dbcon, post_input('type')); // = "reg"
+	$a['port'] = mysqli_real_escape_string($dbcon,post_input('port'));
+	$a['map'] = mysqli_real_escape_string($dbcon, post_input('map'));
+	$a['account_ids'] = mysqli_real_escape_string($dbcon, $_POST['account_id']);
 
 
 	/* temporary default values for now */

programming_language: PHP