CVE-2015-10036 (published 2023-01-11T07:15Z)

A vulnerability was found in kylebebak dronfelipe. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named 87405b74fe651892d79d0dff62ed17a7eaef6a60. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217951.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/kylebebak/dronfelipe
commit_details: repo_url: https://github.com/kylebebak/dronfelipe
author: Kyle Bebak
author_date: 2015-12-15 15:11:20-06:00
msg: this commit is important, it has prevented all sql injection attacks in location_history by either using prepared statements or using mysqli::real_escape_string
repository: repo_url: https://github.com/kylebebak/dronfelipe
repo_name: kylebebak/dronfelipe
description: My website
repo_language: JavaScript
owner: kylebebak
file_changes: filename: __build_query.php
change_type: ModificationType.MODIFY
diff: @@ -3,20 +3,19 @@
 include_once '../models/Location_History.php';
 
 
-
 // range of dates
 if ($dateFilter[0]) {
-	$query .= " AND start_date >= STR_TO_DATE('" . htmlspecialchars($dateFilter[0]) . "', '%m/%d/%Y')";
+	$query .= " AND start_date >= STR_TO_DATE('" . $db->mysqli()->real_escape_string($dateFilter[0]) . "', '%m/%d/%Y')";
 }
 
 if ($dateFilter[1]) {
-	$query .= " AND start_date <= STR_TO_DATE('" . htmlspecialchars($dateFilter[1]) . "', '%m/%d/%Y')";
+	$query .= " AND start_date <= STR_TO_DATE('" . $db->mysqli()->real_escape_string($dateFilter[1]) . "', '%m/%d/%Y')";
 }
 
 
 // filtered-out days
 if (isset($dayFilter)) {
-	$query .= " AND DAYOFWEEK(start_date) NOT IN (" . htmlspecialchars($dayFilter) . ")";
+	$query .= " AND DAYOFWEEK(start_date) NOT IN (" . $dayFilter . ")";
 }
 
 

programming_language: PHP
filename: __parse_query.php
change_type: ModificationType.MODIFY
diff: @@ -6,18 +6,18 @@ include_once '../models/Location_History.php';
 // limit number of results
 $limit = null;
 if ($_POST['limit']) {
-	$limit = $_POST['limit'];
+	$limit = $db->mysqli()->real_escape_string($_POST['limit']);
 }
 
 
 // select only a certain range of dates
 $dayFilter = null;
 if (isset($_POST['dayFilter'])) {
-	$dayFilter = implode(',', $_POST['dayFilter']);
+	$dayFilter = $db->mysqli()->real_escape_string(implode(',', $_POST['dayFilter']));
 }
 
 
-// filter out certain days of the week
+// filter out certain days of the week. the elements of this array are escaped in __build_query.php
 $dateFilter = array('', '');
 if (isset($_POST['dateFilter'])) {
 	$dateFilter = $_POST['dateFilter'];

programming_language: PHP
filename: global.php
change_type: ModificationType.MODIFY
diff: @@ -15,7 +15,7 @@ $query = "SELECT
 // CONSTRUCT WHERE CLAUSE
 include '__build_query.php';
 
-$visits = $db->rawQuery($query, null, false);
+$visits = $db->rawQuery($query, null);
 
 
 
@@ -29,7 +29,7 @@ $query = "SELECT
 // CONSTRUCT WHERE CLAUSE
 include '__build_query.php';
 
-$trips = $db->rawQuery($query, null, false);
+$trips = $db->rawQuery($query, null);
 
 
 echo json_encode(array("visits" => $visits, "trips" =>  $trips));

programming_language: PHP
filename: graph.php
change_type: ModificationType.MODIFY
diff: @@ -9,15 +9,12 @@ if (!$_POST['location_id']) {
 	return;
 }
 
-$location_id = $_POST['location_id'];
-
-
 
 // visits for location
 $query = "SELECT
 	DATE(start_date) AS date, SUM(duration) AS duration
 	FROM grouped_point gp
-	WHERE location_id = " . htmlspecialchars($location_id);
+	WHERE location_id = ?";
 
 
 // CONSTRUCT WHERE CLAUSE
@@ -26,7 +23,7 @@ include '__build_query.php';
 // group by comes after where clause
 $query .= " GROUP BY DATE(start_date)";
 
-$results = $db->rawQuery($query, null, false);
+$results = $db->rawQuery($query, Array($_POST['location_id']));
 
 
 // convert seconds to hours, and make sure that no day is longer than 24 hours, by rolling extra hours over to the next record

programming_language: PHP
filename: main.php
change_type: ModificationType.MODIFY
diff: @@ -24,12 +24,12 @@ $query .= " GROUP BY l.id ORDER BY duration DESC";
 
 // limit clause comes last
 if (isset($limit)) {
-	$query .= " LIMIT " . htmlspecialchars($limit);
+	$query .= " LIMIT " . $limit;
 }
 
 
 
-echo json_encode($db->rawQuery($query, null, false));
+echo json_encode($db->rawQuery($query, null));
 
 
 

programming_language: PHP
filename: trips.php
change_type: ModificationType.MODIFY
diff: @@ -9,7 +9,7 @@ if (!$_POST['location_id']) {
 	return;
 }
 
-$location_id = htmlspecialchars($_POST['location_id']);
+$location_id = $db->mysqli()->real_escape_string($_POST['location_id']);
 
 
 
@@ -28,7 +28,7 @@ AND t.start_location_id = " . $location_id;
 
 include '__build_query.php';
 $query .= " GROUP BY t.end_location_id HAVING count_lid > 1 ORDER BY count_lid DESC";
-$start_aggregate = $db->rawQuery($query, null, false);
+$start_aggregate = $db->rawQuery($query, null);
 
 
 
@@ -50,7 +50,7 @@ AND t.start_location_id = " . $location_id;
 
 include '__build_query.php';
 $query .= " ORDER BY c.count_lid DESC, t.end_location_id, t.start_date ASC";
-$start_all = $db->rawQuery($query, null, false);
+$start_all = $db->rawQuery($query, null);
 
 
 
@@ -67,7 +67,7 @@ AND t.end_location_id = " . $location_id;
 
 include '__build_query.php';
 $query .= " GROUP BY t.start_location_id HAVING count_lid > 1 ORDER BY count_lid DESC";
-$end_aggregate = $db->rawQuery($query, null, false);
+$end_aggregate = $db->rawQuery($query, null);
 
 
 
@@ -89,7 +89,7 @@ AND t.end_location_id = " . $location_id;
 
 include '__build_query.php';
 $query .= " ORDER BY c.count_lid DESC, t.start_location_id, t.end_date ASC";
-$end_all = $db->rawQuery($query, null, false);
+$end_all = $db->rawQuery($query, null);
 
 
 
@@ -109,7 +109,7 @@ include '__build_query.php';
 $query .= " ORDER BY t.start_date ASC) SQ, location ls, location le
 WHERE ls.id = SQ.start_location_id AND le.id = SQ.end_location_id";
 
-$start_end_all = $db->rawQuery($query, null, false);
+$start_end_all = $db->rawQuery($query, null);
 
 
 

programming_language: PHP
filename: visits.php
change_type: ModificationType.MODIFY
diff: @@ -9,14 +9,11 @@ if (!$_POST['location_id']) {
 	return;
 }
 
-$location_id = $_POST['location_id'];
-
-
 // visits for location
 $query = "SELECT
 	DATE(gp.start_date) as start_date, TIME(gp.start_date) as start_time, TIME_TO_SEC(gp.start_date) as start_time_sec, TIME_TO_SEC(gp.end_date) as end_time_sec, duration
 	FROM grouped_point gp
-	WHERE location_id = " . htmlspecialchars($location_id);
+	WHERE location_id = ?";
 
 
 
@@ -24,7 +21,7 @@ $query = "SELECT
 include '__build_query.php';
 include_once '../models/Circular.php';
 
-$results = $db->rawQuery($query, null, false);
+$results = $db->rawQuery($query, Array($_POST['location_id']));
 
 
 $start_times = array();
@@ -43,6 +40,4 @@ echo json_encode(array
 	"results" => $results));
 
 
-
-
 ?>

programming_language: PHP
filename: style.css
change_type: ModificationType.MODIFY
diff: @@ -208,6 +208,10 @@ li#weekdays-container {
 	margin-top: 8px;
 }
 
+label.checkbox {
+	color: black !important;
+}
+
 li#search-container {
 	margin-top: 11px;
 	margin-right: 10px;

programming_language: CSS