CVE-2020-21809 (published 2021-07-30T14:15Z)

SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/nukeviet/module-shops
commit_details: repo_url: https://github.com/nukeviet/module-shops
author: VINADES.,JSC
author_date: 2019-12-23 09:01:16+07:00
msg: Security fixes
repository: repo_url: https://github.com/nukeviet/module-shops
repo_name: nukeviet/module-shops
description: Module Shops for NukeViet
repo_language: PHP
owner: nukeviet
file_changes: filename: detail.php
change_type: ModificationType.MODIFY
diff: @@ -16,9 +16,9 @@ if ($nv_Request->isset_request('check_quantity', 'post')) {
     $id_pro = $nv_Request->get_int('id_pro', 'post', 0);
     $unit = $nv_Request->get_string('pro_unit', 'post', '');
     $listid = $nv_Request->get_string('listid', 'post');
-    $listid = explode(',', $listid);
+    $listid = array_map('intval', explode(',', $listid));
     asort($listid);
-    
+
     $quantity = $db->query('SELECT quantity FROM ' . $db_config['prefix'] . '_' . $module_data . '_group_quantity WHERE pro_id = ' . $id_pro . ' AND listgroup="' . implode(',', $listid) . '"')->fetchColumn();
     if (empty($quantity)) {
         $sum = 0;
@@ -32,7 +32,7 @@ if ($nv_Request->isset_request('check_quantity', 'post')) {
                 }
             }
         }
-        
+
         $result = $db->query('SELECT listgroup, quantity FROM ' . $db_config['prefix'] . '_' . $module_data . '_group_quantity WHERE pro_id = ' . $id_pro);
         while (list ($listgroup, $quantity) = $result->fetch(3)) {
             $listgroup = explode(',', $listgroup);
@@ -46,7 +46,7 @@ if ($nv_Request->isset_request('check_quantity', 'post')) {
                 $sum += $quantity;
             }
         }
-        
+
         if ($sum == 0 or $count == sizeof($listid)) {
             die('NO_0_' . $lang_module['product_empty']);
         } else {
@@ -90,14 +90,14 @@ if ($global_array_shops_cat[$data_content['listcatid']]['form'] != '') {
                 $array_tmp[$row['field']] = unserialize($row['language']);
             }
         }
-        
+
         if (!empty($listfield)) {
             $result = $db->query('SELECT t1.field_value, t2.field FROM ' . $db_config['prefix'] . "_" . $module_data . "_field_value_" . NV_LANG_DATA . ' t1 INNER JOIN ' . $db_config['prefix'] . '_' . $module_data . '_field t2 WHERE t1.field_id=t2.fid AND t1.rows_id=' . $id);
             $data_content['template'] = $global_array_shops_cat[$data_content['listcatid']]['form'];
             while ($row = $result->fetch()) {
                 $data_content['array_custom'][$row['field']] = $row['field_value'];
             }
-            
+
             if (!empty($array_tmp)) {
                 foreach ($array_tmp as $f_key => $field) {
                     foreach ($field as $key_lang => $lang_data) {
@@ -117,31 +117,31 @@ $description = !empty($data_content[NV_LANG_DATA . '_tag_description']) ? $data_
 
 if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
     $popup = $nv_Request->get_int('popup', 'post,get', 0);
-    
+
     $time_set = $nv_Request->get_int($module_data . '_' . $op . '_' . $id, 'session');
     if (empty($time_set)) {
         $nv_Request->set_Session($module_data . '_' . $op . '_' . $id, NV_CURRENTTIME);
         $sql = 'UPDATE ' . $db_config['prefix'] . '_' . $module_data . '_rows SET hitstotal=hitstotal+1 WHERE id=' . $id;
         $db->query($sql);
     }
-    
+
     $catid = $data_content['listcatid'];
     $base_url_rewrite = nv_url_rewrite(NV_BASE_SITEURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&amp;' . NV_NAME_VARIABLE . '=' . $module_name . '&amp;' . NV_OP_VARIABLE . '=' . $global_array_shops_cat[$catid]['alias'] . '/' . $data_content[NV_LANG_DATA . '_alias'] . $global_config['rewrite_exturl'], true);
-    
+
     if ($_SERVER['REQUEST_URI'] != $base_url_rewrite and !$popup) {
         Header('Location: ' . $base_url_rewrite);
         die();
     }
-    
+
     // Lay don vi san pham
     $sql = $db->query('SELECT * FROM ' . $db_config['prefix'] . '_' . $module_data . '_units WHERE id = ' . $data_content['product_unit']);
     $data_unit = $sql->fetch();
     $data_unit['title'] = $data_unit[NV_LANG_DATA . '_title'];
-    
+
     // Hien thi tabs
     $sql = 'SELECT * FROM ' . $db_config['prefix'] . '_' . $module_data . '_tabs where active=1 ORDER BY weight ASC';
     $data_content['tabs'] = $nv_Cache->db($sql, 'id', $module_name);
-    
+
     $data_content['files'] = array();
     if (!empty($data_content['tabs'])) {
         // Download tai lieu san pham
@@ -153,7 +153,7 @@ if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
             }
         }
     }
-    
+
     // Danh gia - Phan hoi
     $rating_total = 0;
     $result = $db->query('SELECT rating FROM ' . $db_config['prefix'] . '_' . $module_data . '_review WHERE product_id = ' . $data_content['id'] . ' AND status=1');
@@ -166,7 +166,7 @@ if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
     $data_content['rating_total'] = $rating_count;
     $data_content['rating_point'] = $rating_total;
     $data_content['rating_value'] = $rating_count > 0 ? round($rating_total / $rating_count) : 0;
-    
+
     // Xac dinh anh lon
     $homeimgfile = $data_content['homeimgfile'];
     if ($data_content['homeimgthumb'] == 1) {
@@ -183,7 +183,7 @@ if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
         // no image
         $data_content['homeimgthumb'] = NV_BASE_SITEURL . 'themes/' . $module_info['template'] . '/images/' . $module_file . '/no-image.jpg';
     }
-    
+
     // Tu khoa
     $array_keyword = array();
     $key_words = array();
@@ -193,10 +193,10 @@ if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
         $key_words[] = $row['keyword'];
     }
     $key_words = !empty($key_words) ? implode(',', $key_words) : '';
-    
+
     // metatag image facebook
     $meta_property['og:image'] = NV_MY_DOMAIN . $data_content['homeimgfile'];
-    
+
     // Fetch Limit
     $db->sqlreset()
         ->select(' id, listcatid, ' . NV_LANG_DATA . '_title, ' . NV_LANG_DATA . '_alias, homeimgfile, homeimgthumb, addtime, publtime, product_code, product_number, product_price, price_config, money_unit, discount_id, showprice, ' . NV_LANG_DATA . '_hometext,' . NV_LANG_DATA . '_gift_content, gift_from, gift_to')
@@ -205,7 +205,7 @@ if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
         ->order('ID DESC')
         ->limit($pro_config['per_row'] * 2);
     $result = $db->query($db->sql());
-    
+
     $data_others = array();
     while (list ($_id, $listcatid, $title, $alias, $homeimgfile, $homeimgthumb, $addtime, $publtime, $product_code, $product_number, $product_price, $price_config, $money_unit, $discount_id, $showprice, $hometext, $gift_content, $gift_from, $gift_to) = $result->fetch(3)) {
         if ($homeimgthumb == 1) {
@@ -221,7 +221,7 @@ if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
             // no image
             $thumb = NV_BASE_SITEURL . 'themes/' . $module_info['template'] . '/images/' . $module_file . '/no-image.jpg';
         }
-        
+
         $data_others[] = array(
             'id' => $_id,
             'listcatid' => $listcatid,
@@ -246,7 +246,7 @@ if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
             'link_order' => NV_BASE_SITEURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&amp;' . NV_NAME_VARIABLE . '=' . $module_name . '&amp;' . NV_OP_VARIABLE . '=setcart&amp;id=' . $_id
         );
     }
-    
+
     $array_other_view = array();
     if (!empty($_SESSION[$module_data . '_proview'])) {
         $arrid = array();
@@ -279,7 +279,7 @@ if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
                     // no image
                     $thumb = NV_BASE_SITEURL . 'themes/' . $module_info['template'] . '/images/' . $module_file . '/no-image.jpg';
                 }
-                
+
                 $array_other_view[] = array(
                     'id' => $_id,
                     'listcatid' => $listcatid,
@@ -305,9 +305,9 @@ if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
             }
         }
     }
-    
+
     SetSessionProView($data_content['id'], $data_content[NV_LANG_DATA . '_title'], $data_content[NV_LANG_DATA . '_alias'], $data_content['addtime'], NV_BASE_SITEURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&' . NV_NAME_VARIABLE . '=' . $module_name . '&' . NV_OP_VARIABLE . '=' . $global_array_shops_cat[$catid]['alias'] . '/' . $data_content[NV_LANG_DATA . '_alias'] . '-' . $data_content['id'], $data_content['homeimgthumb']);
-    
+
     // comment
     if (isset($site_mods['comment']) and isset($module_config[$module_name]['activecomm'])) {
         define('NV_COMM_ID', $data_content['id']); // ID bài viết hoặc
@@ -321,12 +321,12 @@ if (nv_user_in_groups($global_array_shops_cat[$catid]['groups_view'])) {
         require_once NV_ROOTDIR . '/modules/comment/comment.php';
         $area = (defined('NV_COMM_AREA')) ? NV_COMM_AREA : 0;
         $checkss = md5($module_name . '-' . $area . '-' . NV_COMM_ID . '-' . $allowed . '-' . NV_CACHE_PREFIX);
-        
+
         $content_comment = nv_comment_module($module_name, $checkss, $area, NV_COMM_ID, $allowed, 1);
     } else {
         $content_comment = '';
     }
-    
+
     $contents = detail_product($data_content, $data_unit, $data_others, $array_other_view, $content_comment, $compare_id, $popup, $idtemplate, $array_keyword);
 } else {
     $nv_redirect = NV_BASE_SITEURL . 'index.php?' . NV_LANG_VARIABLE . '=' . NV_LANG_DATA . '&amp;' . NV_NAME_VARIABLE . '=' . $module_name;
@@ -339,4 +339,4 @@ if ($popup) {
     include NV_ROOTDIR . '/includes/header.php';
     echo nv_site_theme($contents);
     include NV_ROOTDIR . '/includes/footer.php';
-}
\ No newline at end of file
+}

programming_language: PHP
filename: search_result.php
change_type: ModificationType.MODIFY
diff: @@ -38,7 +38,7 @@ if (! empty($group_price)) {
     if (!empty($group_price)) {
         $search .= " AND";
         foreach ($group_price as $i => $group_price_i) {
-            $group_price_i = explode('-', $group_price_i);
+            $group_price_i = array_map('intval', explode('-', $group_price_i));
             if ($group_price_i[0] <= $group_price_i[1]) {
                 $search .= ($i > 0 ? " OR " : "") . " product_price BETWEEN " . $group_price_i[0] . " AND " . $group_price_i[1] . " ";
             } else {

programming_language: PHP