CVE-2015-10097 (published 2023-03-25T18:15Z)

A vulnerability was found in grinnellplans-php up to 3.0. It has been declared as critical. Affected by this vulnerability is the function interface_disp_page/interface_disp_page of the file read.php. The manipulation leads to sql injection. The attack can be launched remotely. The identifier of the patch is 57e4409e19203a94495140ff1b5a697734d17cfb. It is recommended to apply a patch to fix this issue. The identifier VDB-223801 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/grinnellplans/grinnellplans-php
commit_details: repo_url: https://github.com/grinnellplans/grinnellplans-php
author: alex
author_date: 2015-04-04 13:53:40+00:00
msg: Fix SQL injection in read.php's  - thanks, stjohns\!
repository: repo_url: https://github.com/grinnellplans/grinnellplans-php
repo_name: grinnellplans/grinnellplans-php
description: Automatically exported from code.google.com/p/grinnellplans
repo_language: PHP
owner: grinnellplans
file_changes: filename: read.php
change_type: ModificationType.MODIFY
diff: @@ -71,7 +71,7 @@ if (!$searchnum) //if no search number given
 if (User::logged_in()) {
     //TODO add searchname instead?
     $page->url = add_param($page->url, 'searchnum', $searchnum);
-    $addtolist = (isset($_POST['addtolist']) ? $_POST['addtolist'] : false);
+    $addtolist = (isset($_POST['addtolist']) ? (bool)$_POST['addtolist'] : false);
     // if person is manipulating which tier this plan is on their autoread list
     if (isset($_POST['block_user'])) {
         if ($_POST['block_user'] == 1) {
@@ -91,12 +91,12 @@ simply by logging out. If you would like to change this setting, please visit
             $msg = new InfoText("User " . $planinfo[0][0] . " has been unblocked.");
         }
         $page->append($msg);
-    } else if ($addtolist == 1) {
-        $privlevel = (isset($_POST['privlevel']) ? $_POST['privlevel'] : 0);
+    } else if ($addtolist) {
+        $privlevel = (isset($_POST['privlevel']) ? (int)$_POST['privlevel'] : 0);
         if ($privlevel == 0) {
             mysql_query("DELETE FROM autofinger WHERE owner = '$idcookie' and interest = '$searchnum'");
             $yay = new InfoText("User " . $planinfo[0][0] . " removed from your autoread list.");
-        } else {
+        } else if ($privlevel > 0 && $privlevel <= 3) {
             mysql_query("INSERT INTO autofinger (owner, interest, priority) VALUES ('$idcookie', '$searchnum', '$privlevel') ON DUPLICATE KEY UPDATE priority=$privlevel");
             $yay = new InfoText("User " . $planinfo[0][0] . " is now on your autoread list with priority level of " . $privlevel . ".");
         }

programming_language: PHP