CVE-2015-10064 (published 2023-01-17T19:15Z)

A vulnerability was found in VictorFerraresi pokemon-database-php. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named dd0e1e6cdf648d6a3deff441f515bcb1d7573d68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218455.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/VictorFerraresi/pokemon-database-php
commit_details: repo_url: https://github.com/VictorFerraresi/pokemon-database-php
author: 41419839
author_date: 2015-05-06 09:36:28-03:00
msg: Removida a vulnerabilidade do site à SQL Injection.
repository: repo_url: https://github.com/VictorFerraresi/pokemon-database-php
repo_name: VictorFerraresi/pokemon-database-php
description: Projeto de WebApplication em PHP. Victor Ferraresi, Otavio Roman, Murilo Cipollari
repo_language: PHP
owner: VictorFerraresi
file_changes: filename: addStrike.php
change_type: ModificationType.MODIFY
diff: @@ -8,14 +8,16 @@ if(isset($_POST['submit'])){
 else {
     header("location:./");
 }
-function tryAddStrike($name, $damage, $type){     
-    $result = mysql_query("SELECT * FROM `pokemon`.`golpes` WHERE name = '$name' LIMIT 1");    
+function tryAddStrike($name, $damage, $type){   
+    $ename = mysql_real_escape_string($name);
+    $edamage = mysql_real_escape_string($damage);
+    $result = mysql_query("SELECT * FROM `pokemon`.`golpes` WHERE name = '$ename' LIMIT 1");    
 
     if(mysql_num_rows($result) >= 1){ //Se ja existir o golpe
         $_SESSION['error'] = 1;
         header("location:acp.php");
     } else {
-        $result = mysql_query("INSERT INTO `pokemon`.`golpes` (`name`, `damage`, `type`) VALUES ('$name', '$damage', '$type')");            
+        $result = mysql_query("INSERT INTO `pokemon`.`golpes` (`name`, `damage`, `type`) VALUES ('$ename', '$edamage', '$type')");            
         $_SESSION['error'] = 2; //Apesar do nome da variável da sessão, é uma instrução apenas
         header("location:acp.php");
     }

programming_language: PHP
filename: editStrike.php
change_type: ModificationType.MODIFY
diff: @@ -9,14 +9,15 @@ else {
     header("location:./");
 }
 function tryEditStrike($id, $name, $damage, $type){ 
-
+    $ename = mysql_real_escape_string($name);
+    $edamage = mysql_real_escape_string($damage);
     $result = mysql_query("SELECT * FROM `pokemon`.`golpes` WHERE id = '$id' LIMIT 1");    
 
     if(mysql_num_rows($result) == 0){ //Se não existir golpe com este ID
         $_SESSION['error2'] = 3;
         header("location:acp.php");
     } else {
-        $result = mysql_query("UPDATE `pokemon`.`golpes` SET `name` = '$name', `damage` = '$damage', `type` = '$type' WHERE `id` = '$id'");            
+        $result = mysql_query("UPDATE `pokemon`.`golpes` SET `name` = '$ename', `damage` = '$edamage', `type` = '$type' WHERE `id` = '$id'");            
         $_SESSION['error2'] = 4; //Apesar do nome da variável da sessão, é uma instrução apenas
         header("location:acp.php");
     }

programming_language: PHP
filename: golpes.php
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,8 @@
 <?php
-    require 'mysqlcon.php';     
+    require 'mysqlcon.php';       
     $a = $_GET["golpe"];
-    $sth = mysql_query("SELECT `name` FROM `pokemon`.`golpes` where name like '" . $a."%'");
+    $ea = mysql_real_escape_string($a);
+    $sth = mysql_query("SELECT `name` FROM `pokemon`.`golpes` where name like '" . $ea."%'");
     $rows = array();
     while($r = mysql_fetch_assoc($sth)) {
         $rows[] = $r;

programming_language: PHP
filename: validateRegister.php
change_type: ModificationType.MODIFY
diff: @@ -16,20 +16,22 @@ if(isset($_POST['submit'])){
 else {
     header("location:./");
 }
-function tryRegister($user, $email, $pass){     
-    $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE user = '$user' LIMIT 1");    
+function tryRegister($user, $email, $pass){   
+    $euser = mysql_real_escape_string($user);
+    $eemail = mysql_real_escape_string($email);
+    $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE user = '$euser' LIMIT 1");    
 
     if(mysql_num_rows($result) >= 1){ //Se ja existir o usuário
         $_SESSION['error'] = 2;
         header("location:register.php");
     } else {
-        $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE email = '$email' LIMIT 1");
+        $result = mysql_query("SELECT * FROM `pokemon`.`usuarios` WHERE email = '$eemail' LIMIT 1");
         if(mysql_num_rows($result) >= 1){ //Se ja existir o email
             $_SESSION['error'] = 3;
             header("location:register.php");
         } else { //Se a conta estiver 100% apta ao registro
             //Inserimos a conta no banco de dados
-            $result = mysql_query("INSERT INTO `pokemon`.`usuarios` (`user`, `email`, `password`) VALUES ('$user', '$email', '$pass')");            
+            $result = mysql_query("INSERT INTO `pokemon`.`usuarios` (`user`, `email`, `password`) VALUES ('$euser', '$eemail', '$pass')");            
             $_SESSION['error'] = 2; //Apesar do nome da variável da sessão, é uma instrução apenas
             header("location:login.php");
         }

programming_language: PHP