CVE-2016-2555 (published 2017-04-13T14:59Z)

SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/atutor/ATutor
commit_details: repo_url: https://github.com/atutor/ATutor
author: Steven Seeley
author_date: 2016-03-07 09:12:46-05:00
msg: Update mysql_connect.inc.php

This one patch, patches all SQL Injection that I found
repository: repo_url: https://github.com/atutor/ATutor
repo_name: atutor/ATutor
description: NO LONGER USER LEVEL SUPPORTED. CONTRIBUTING DEVELOPERS INTERESTED IN MAINTAINING ATUTOR, SHOULD REQUEST COLLABORATOR ACCESS. : ATutor is an Open Source Web-based Learning Management System (LMS) used to develop and deliver online courses. Administrators can install or update ATutor in minutes, develop custom themes to give ATutor a new look, and easily extend its functionality with feature modules. Educators can quickly assemble, package, and redistribute standardized Web-based instructional content, easily import prepackaged content, and conduct their courses online. Students learn in an accessible, adaptive, social learning environment.
repo_language: PHP
owner: atutor
file_changes: filename: mysql_connect.inc.php
change_type: ModificationType.MODIFY
diff: @@ -93,14 +93,8 @@ if ( get_magic_quotes_gpc() == 1 ) {
     $addslashes   = 'my_add_null_slashes';
     $stripslashes = 'stripslashes';
 } else {
-    if(defined('MYSQLI_ENABLED')){
-        // mysqli_real_escape_string requires 2 params, breaking wherever
-        // current $addslashes with 1 param exists. So hack with trim and 
-        // manually run mysqli_real_escape_string requires during sanitization below
-        $addslashes   = 'trim';
-    }else{
-        $addslashes   = 'mysql_real_escape_string';
-    }
+    // if get_magic_quotes_gpc is off, we set our own handler
+    $addslashes   = 'mysql_real_escape_string';
     $stripslashes = 'my_null_slashes';
 }
 
@@ -406,4 +400,4 @@ function at_field_name($result, $i){
 }
 
 ////
-?>
\ No newline at end of file
+?>

programming_language: PHP
repo_url: https://github.com/atutor/ATutor
commit_details: repo_url: https://github.com/atutor/ATutor
author: ATutor
author_date: 2016-03-07 19:18:23-05:00
msg: Merge pull request #106 from net-ninja/patch-1

Update mysql_connect.inc.php to replace mysqli trim with mysql_real_escape_string to properly filter potential injection attempts, thx mr_me aka net-ninja
repository: repo_url: https://github.com/atutor/ATutor
repo_name: atutor/ATutor
description: NO LONGER USER LEVEL SUPPORTED. CONTRIBUTING DEVELOPERS INTERESTED IN MAINTAINING ATUTOR, SHOULD REQUEST COLLABORATOR ACCESS. : ATutor is an Open Source Web-based Learning Management System (LMS) used to develop and deliver online courses. Administrators can install or update ATutor in minutes, develop custom themes to give ATutor a new look, and easily extend its functionality with feature modules. Educators can quickly assemble, package, and redistribute standardized Web-based instructional content, easily import prepackaged content, and conduct their courses online. Students learn in an accessible, adaptive, social learning environment.
repo_language: PHP
owner: atutor