CVE-2018-9250 (published 2018-05-18T14:29Z)

interface\\super\\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/openemr/openemr
commit_details: repo_url: https://github.com/openemr/openemr
author: Brady Miller
author_date: 2018-04-26 00:20:46-07:00
msg: security fix (#1578)
repository: repo_url: https://github.com/openemr/openemr
repo_name: openemr/openemr
description: The most popular open source electronic health records and medical practice management solution.
repo_language: PHP
owner: openemr
file_changes: filename: edit_list.php
change_type: ModificationType.MODIFY
diff: @@ -2,25 +2,14 @@
 /**
  * Administration Lists Module.
  *
- * Copyright (C) 2007-2017 Rod Roark <rod@sunsetsystems.com>
- * Copyright (C) 2017      Brady Miller <brady.g.miller@gmail.com>
- *
- * LICENSE: This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
- *
- * @package OpenEMR
- * @author  Rod Roark <rod@sunsetsystems.com>
- * @author  Brady Miller <brady.g.miller@gmail.com>
- * @author  Teny <teny@zhservices.com>
- * @link    http://www.open-emr.org
+ * @package   OpenEMR
+ * @link      http://www.open-emr.org
+ * @author    Rod Roark <rod@sunsetsystems.com>
+ * @author    Brady Miller <brady.g.miller@gmail.com>
+ * @author    Teny <teny@zhservices.com>
+ * @copyright Copyright (c) 2007-2017 Rod Roark <rod@sunsetsystems.com>
+ * @copyright Copyright (c) 2017-2018 Brady Miller <brady.g.miller@gmail.com>
+ * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
  */
 
 require_once("../globals.php");
@@ -29,6 +18,7 @@ require_once("$phpgacl_location/gacl_api.class.php");
 require_once("$srcdir/lists.inc");
 require_once("../../custom/code_types.inc.php");
 require_once("$srcdir/options.inc.php");
+
 use OpenEMR\Core\Header;
 
 // Below allows the list to default to the first item on the list
@@ -225,12 +215,7 @@ if ($_POST['formaction'] == 'save' && $list_id) {
     // add the new list to the list-of-lists
     sqlInsert("INSERT INTO list_options ( " .
         "list_id, option_id, title, seq, is_default, option_value " .
-        ") VALUES ( " .
-        "'lists'," . // the master list-of-lists
-        "'" . $newlistID . "'," .
-        "'" . $_POST['newlistname'] . "', " .
-        "'" . ($row['maxseq'] + 1) . "'," .
-        "'1', '0')");
+        ") VALUES ( 'lists', ?, ?, ?, '1', '0')", array($newlistID, $_POST['newlistname'], ($row['maxseq'] + 1)));
     $list_id = $newlistID;
 } elseif ($_POST['formaction'] == 'deletelist') {
     // delete the lists options
@@ -325,7 +310,7 @@ function writeOptionLine(
     echo "<input type='checkbox' name='opt[$opt_line_no][default]' value='1' " .
         "onclick='defClicked($opt_line_no)' class='optin'$checked />";
     echo "</td>\n";
-    
+
     if (preg_match('/Eye_QP_/', $list_id)) {
         echo "  <td>";
         echo "<select name='opt[$opt_line_no][activity]' class='optin'>";

programming_language: PHP