CVE-2015-1428 (published 2015-02-03T16:59Z)

Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/sefrengo-cms/sefrengo-1.x
commit_details: repo_url: https://github.com/sefrengo-cms/sefrengo-1.x
author: Holger Stitz
author_date: 2015-01-25 19:36:29+01:00
msg: Updated version number to v1.6.2
repository: repo_url: https://github.com/sefrengo-cms/sefrengo-1.x
repo_name: sefrengo-cms/sefrengo-1.x
description: Active development of the open-source conent management system Sefrengo.
repo_language: PHP
owner: sefrengo-cms
file_changes: filename: changelog.md
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,18 @@
 Changelog
 ================================================================================================
 
+Sefrengo v1.6.2
+------------------------------------------------------------------------------------------------
+Internal versionnumber: 01.06.02<br/>
+Release: 25.01.2015
+
+See full changelog at <https://github.com/sefrengo-cms/sefrengo-1.x/commits/v1.6.2>
+
+* FIXED: Escaped strings for session ids and name
+* ADDED: Sortable CSS and JS files for layouts (thanks to sidd)
+
+
+
 Sefrengo v1.6.1
 ------------------------------------------------------------------------------------------------
 Internal versionnumber: 01.06.01<br/>

programming_language: Markdown
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -129,7 +129,8 @@ class setup {
 							'updates_from.01.04.06.sql',
 							'updates_from.01.05.00.sql',
 							'updates_from.01.05.01.sql',
-							'updates_from.01.06.00.sql');
+							'updates_from.01.06.00.sql',
+							'updates_from.01.06.01.sql');
 
 	/**
 	* Konstruktor. Catch all globals
@@ -139,7 +140,7 @@ class setup {
 		$this -> catch_globals();
 		$this -> version['prior'] = '01';
 		$this -> version['minor'] = '06';
-		$this -> version['fix']   = '01';
+		$this -> version['fix']   = '02';
 		$this -> version_text = $this -> version['prior'];
 		$this -> version_text .= '.';
 		$this -> version_text .= $this -> version['minor'];

programming_language: PHP
filename: config.sql
change_type: ModificationType.MODIFY
diff: @@ -321,7 +321,7 @@ INSERT INTO cms_values VALUES ('', 0, 0, 'css_units', 'auto', 'v', '', '', 'auto
 INSERT INTO cms_values VALUES ('', 0, 0, 'css_units', 'attachment', 'v', '', '', 'fixed|scroll', 0, NULL, NULL, 'txt', NULL, NULL, 0);
 
 # cms config
-INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'version', '', '', '', '01.06.01', '0', NULL, NULL, '', NULL, NULL, '0');
+INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'version', '', '', '', '01.06.02', '0', NULL, NULL, '', NULL, NULL, '0');
 
 INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'cms_path', NULL, NULL, NULL, '<!--{cms_path}-->backend/', 100, 'set_cms_path', NULL, 'txt', NULL, NULL, '1');
 INSERT INTO cms_values VALUES ('', 0, 0, 'cfg', 'cms_html_path', NULL, NULL, NULL, '<!--{cms_full_http_path}-->backend/', 101, 'set_html_path', NULL, 'txt', NULL, NULL, '1');

programming_language: SQL
filename: updates_from.01.06.01.sql
change_type: ModificationType.ADD
diff: @@ -0,0 +1,2 @@
+# 25.01.2015 set new versionnumber - Sefrengo 1.6.2
+UPDATE cms_values  SET value =  '01.06.02' WHERE group_name =  'cfg' AND key1 =  'version';

programming_language: SQL
repo_url: https://github.com/sefrengo-cms/sefrengo-1.x
commit_details: repo_url: https://github.com/sefrengo-cms/sefrengo-1.x
author: Holger Stitz
author_date: 2015-01-13 00:01:43+01:00
msg: Escaped strings for session ids and name
repository: repo_url: https://github.com/sefrengo-cms/sefrengo-1.x
repo_name: sefrengo-cms/sefrengo-1.x
description: Active development of the open-source conent management system Sefrengo.
repo_language: PHP
owner: sefrengo-cms
file_changes: filename: local.php
change_type: ModificationType.MODIFY
diff: @@ -169,7 +169,7 @@ class DB_cms extends DB_Sql {
 													WHERE
 													name = '" . addslashes( $this->cache_name ) . "'
 													AND
-													sid = '" . $this->cache_id . "'";
+													sid = '" . addslashes( $this->cache_id ) . "'";
                     $this->cache_db->query( $sql );
                     break;
             } 
@@ -259,9 +259,9 @@ class DB_cms extends DB_Sql {
             $return = false;
             $sql = "SELECT val FROM
 								 " . $cms_db['db_cache'] . " WHERE
-									 name = '" . $this->cache_name . "'
+									 name = '" . addslashes( $this->cache_name ) . "'
 									 AND
-									 sid =  '" . $cache_id . "'";
+									 sid =  '" . addslashes( $cache_id ) . "'";
             if ( !$this->cache_db->query( $sql ) ) return;
             $oldmode = $this->cache_db->get_fetch_mode();
             $this->cache_db->set_fetch_mode( 'DB_FETCH_ASSOC' );
@@ -428,11 +428,11 @@ class cms_CT_Sql extends CT_Sql {
         $ret = true;
         $cquery = sprintf("select count(*) from %s where sid='%s' and name='%s'",
             $cms_db['sessions'],
-            $id,
-            $name);
+            addslashes($id),
+            addslashes($name));
         $squery = sprintf("select sid from %s where sid  = '%s' and name = '%s'",
             $cms_db['sessions'],
-            $id,
+            addslashes($id),
             addslashes($name));
         $this->db->query($squery);
         if ( $this->db->affected_rows() == 0
@@ -454,8 +454,8 @@ class cms_CT_Sql extends CT_Sql {
             $this->db->query(sprintf("delete from %s where name = '%s' and sid != '%s' and user_id = '%s'",
                 $cms_db[sessions],
                 addslashes($name),
-                $str,
-                $id));
+                addslashes($str),
+                addslashes($id)));
         }
     }
     function ac_sigleid($name, $id) {
@@ -467,11 +467,11 @@ class cms_CT_Sql extends CT_Sql {
             $ret = false;
             $cquery = sprintf("select count(*) from %s where user_id='%s' and name='%s'",
                 $cms_db['sessions'],
-                $id,
-                $name);
+                addslashes($id),
+                addslashes($name));
             $squery = sprintf("select sid from %s where user_id='%s' and name='%s'",
                 $cms_db['sessions'],
-                $id,
+                addslashes($id),
                 addslashes($name));
             $this->db->query($squery);
             if ( $this->db->affected_rows() == 0

programming_language: PHP