CVE-2014-9528 (published 2015-01-06T15:59Z)

SQL injection vulnerability in the actionIndex function in protected/modules_core/notification/controllers/ListController.php in HumHub 0.10.0-rc.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the from parameter to index.php. NOTE: this can be leveraged for cross-site scripting (XSS) attacks via a request that causes an error.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/humhub/humhub
commit_details: repo_url: https://github.com/humhub/humhub
author: Lucas Bartholemy
author_date: 2014-11-28 14:49:54+01:00
msg: Added option to flush log entries
repository: repo_url: https://github.com/humhub/humhub
repo_name: humhub/humhub
description: HumHub is an Open Source Enterprise Social Network. Easy to install, intuitive to use and extendable with countless freely available modules.
repo_language: PHP
owner: humhub
file_changes: filename: CmsInput.php
change_type: ModificationType.MODIFY
diff: @@ -164,7 +164,7 @@ class CmsInput extends CApplicationComponent
      */
     public function stripClean($str)
     {
-        return $this->xssClean($this->stripTags($str));
+        return $this->stripTags($this->xssClean($str));
     }
     
     /**

programming_language: PHP
filename: LoggingController.php
change_type: ModificationType.MODIFY
diff: @@ -82,4 +82,11 @@ class LoggingController extends Controller
         ));
     }
 
+    public function actionFlush()
+    {
+        $this->forcePostRequest();
+        Logging::model()->deleteAll();
+        $this->redirect($this->createUrl('index'));
+    }
+
 }

programming_language: PHP
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -2,13 +2,16 @@
     <div class="panel-heading"><?php echo Yii::t('AdminModule.views_logging_index', '<strong>Error</strong> logging'); ?></div>
     <div class="panel-body">
 
+        
         <div>
             <?php echo Yii::t('AdminModule.views_logging_index', 'Total {count} entries found.', array("{count}" => $itemCount)); ?>
-            <span
-                class="pull-right"><?php echo Yii::t('AdminModule.views_logging_index', 'Displaying {count} entries per page.', array("{count}" => $pageSize)); ?></span>
+            
+            <span class="pull-right"><?php echo Yii::t('AdminModule.views_logging_index', 'Displaying {count} entries per page.', array("{count}" => $pageSize)); ?></span>
         </div>
 
         <hr>
+        
+        
 
         <ul class="media-list">
             <?php foreach ($entries as $entry) : ?>
@@ -28,17 +31,21 @@
                         ?>
 
                         <h4 class="media-heading">
-                            <span class="label <?php echo $labelClass; ?>"><?php echo $entry->level; ?></span>&nbsp;
+                            <span class="label <?php echo $labelClass; ?>"><?php echo CHtml::encode($entry->level); ?></span>&nbsp;
                             <?php echo date('r', $entry->logtime); ?>&nbsp;
-                            <span class="pull-right"><?php echo $entry->category; ?></span>
+                            <span class="pull-right"><?php echo CHtml::encode($entry->category); ?></span>
                         </h4>
-                        <?php echo $entry->message; ?>
+                        <?php echo CHtml::encode($entry->message); ?>
                     </div>
                 </li>
 
             <?php endforeach; ?>
         </ul>
 
+        <?php if ($itemCount != 0): ?>
+            <div class="pull-right"><?php echo HHtml::postLink('Flush entries', array('flush'), array('class'=>'btn btn-danger')); ?></div>
+        <?php endif; ?>
+    
 
         <center>
             <?php

programming_language: PHP
filename: ListController.php
change_type: ModificationType.MODIFY
diff: @@ -43,13 +43,14 @@ class ListController extends Controller
     {
 
         // the id from the last entry loaded
-        $lastEntryId = Yii::app()->request->getParam('from');
+        $lastEntryId = (int) Yii::app()->request->getParam('from');
 
         // create database query
         $criteria = new CDbCriteria();
         if ($lastEntryId > 0) {
             // start from last entry id loaded
-            $criteria->condition = 'id<' . $lastEntryId;
+            $criteria->condition = 'id<:lastEntryId';
+            $criteria->params = array(':lastEntryId' => $lastEntryId);
         }
         $criteria->order = 'seen ASC, created_at DESC';
         $criteria->limit = 6;

programming_language: PHP