CVE-2017-20150 (published 2022-12-28T19:15Z)

A vulnerability was found in challenge website. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The name of the patch is f1644b1d3502e5aa5284f31ea80d2623817f4d42. It is recommended to apply a patch to fix this issue. The identifier VDB-216989 was assigned to this vulnerability.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/Challenge/website
commit_details: repo_url: https://github.com/Challenge/website
author: thraundil
author_date: 2017-01-24 17:51:21+01:00
msg: Now without SQL injections!
repository: repo_url: https://github.com/Challenge/website
repo_name: Challenge/website
description: Contains files used for the new DIKULAN website (which does not depend on Joomla).
repo_language: PHP
owner: Challenge
file_changes: filename: Turinfo.php
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,10 @@
 <html>
 <?php
-echo "<h1>" . $_GET['INFO'] . "</h1>";
 $info = $_GET['INFO'];
+$info = stripslashes($info);
+$info = mysqli_real_escape_string($info);
+echo "<h1>" . $info . "</h1>";
+
 ?>
 
 <!-- Denne del står for information/descrpiton, venstre side af turnerings-informationssiden -->
@@ -15,7 +18,7 @@ $info = $_GET['INFO'];
         echo ("<div id='turDesc'>
 			  <table class='turneringTable' style='width:80%; '>
 				<tr>
-						<td>" . $_GET['INFO'] . " </br> " . $row['Dag'] . " kl." . $row['Tid'] . "</td>
+						<td>" . $info . " </br> " . $row['Dag'] . " kl." . $row['Tid'] . "</td>
 				</tr>
 				<tr>
 						<td> ");

programming_language: PHP
filename: Turtabel.php
change_type: ModificationType.MODIFY
diff: @@ -1,14 +1,27 @@
 <?php
 if (isset($_GET['cmd'])) {
-    $tur = $_GET['Turnering'];
-    $navn = $_GET['Navn'];
-    $tag = $_GET['Gametag'];
-    $Bid = $_GET['BordID'];
-    $uni = $_GET['Turnering'] . " " . $_GET['Navn'] . " " . $_GET['Gametag'];
+
+    $turInput = $_GET['Turnering'];
+    $turInput = stripslashes($turInput);
+    $turInput = mysqli_real_escape_string($turInput);
+
+    $nameInput = $_GET['Navn'];
+    $nameInput = stripslashes($nameInput);
+    $nameInput = mysqli_real_escape_string($nameInput);
+
+    $gameInput = $_GET['Gametag'];
+    $gameInput = stripslashes($gameInput);
+    $gameInput = mysqli_real_escape_string($gameInput);
+
+    $bordInput = $_GET['BordID'];
+    $bordInput = stripslashes($bordInput);
+    $bordInput = mysqli_real_escape_string($bordInput);            
+
+    $uni = $turInput . " " . $nameInput . " " . $gameInput;
 
     if ($tur != '0') {
         $sql = "INSERT INTO deltager (TurneringsID , Navn , Gamertag , BordID , Unik)"
-                . "VALUES ($tur , '$navn' , '$tag' , '$Bid' , '$uni' )";
+                . "VALUES ($tur , '$nameInput' , '$gameInput' , '$bordInput' , '$uni' )";
     }
 }
 ?>
@@ -44,10 +57,10 @@ if (isset($_GET['cmd'])) {
 <!-- Den følgende php står for fejlbeskeder/successbeskeder ved tilmelding til turnering-->
 <?php
 if (isset($_REQUEST['cmd'])) {
-    if ($navn > "%") {
-        if ($tag > "%") {
-            if ($Bid > 0 && $Bid < 88) {
-                if ($tur != '0') {
+    if ($nameInput > "%") {
+        if ($gameInput > "%") {
+            if ($bordInput > 0 && $bordInput < 88) {
+                if ($turInput != '0') {
                     mysqli_query($db, $sql);
                     echo "<h2 text align=\"center\">Succes</h2>";
                 } else {

programming_language: PHP
filename: adminindex.php
change_type: ModificationType.MODIFY
diff: @@ -14,50 +14,61 @@ echo ($_SESSION['myusername']);
 								// Dette sker når der klikkes "Opdater"
 								if(isset($_POST["submit"]))
 								{
+
+									$forside1stor2 = mysqli_real_escape_string(stripslashes($_POST['forside1stor2']));
+									$forside1 = mysqli_real_escape_string(stripslashes($_POST['forside1']));
+									$forside2stor = mysqli_real_escape_string(stripslashes($_POST['forside2stor']));
+									$forside2 = mysqli_real_escape_string(stripslashes($_POST['forside2']));
+									$forside3stor = mysqli_real_escape_string(stripslashes($_POST['forside3stor']));
+									$forside3 = mysqli_real_escape_string(stripslashes($_POST['forside3']));
+									$forside4stor = mysqli_real_escape_string(stripslashes($_POST['forside4stor']));
+									$forside4 = mysqli_real_escape_string(stripslashes($_POST['forside4']));
+
+
 									// Overskriften
-									$forside1stor3 = $_POST['forside1stor2'];
+									$forside1stor3 = $forside1stor2;
 									$forside1stor3 = mysqli_escape_string($db,$forside1stor3);
 									$q = "UPDATE forside SET `desc`='" . $forside1stor3 . "' WHERE num = 1;";
 									mysqli_query($db, $q);
 								
 									// Undertekst til overskriften
-									$forside1 = $_POST['forside1'];
+									$forside1 = $forside1;
 									$forside1 = mysqli_escape_string($db,$forside1);
 									$q2 = "UPDATE forside SET `desc`='" . $forside1 . "' WHERE num = 2;";
 									mysqli_query($db, $q2);
 									
 									// Overskrift lille vindue 1
-									$forside2stor = $_POST['forside2stor'];
+									$forside2stor = $forside2stor;
 									$forside2stor = mysqli_escape_string($db,$forside2stor);
 									$q2 = "UPDATE forside SET `desc`='" . $forside2stor . "' WHERE num = 3;";
 									mysqli_query($db, $q2);
 									
 									// Undertekst til vindue 1
-									$forside2 = $_POST['forside2'];
+									$forside2 = $forside2;
 									$forside2 = mysqli_escape_string($db,$forside2);
 									$q3 = "UPDATE forside SET `desc`='" . $forside2 . "' WHERE num = 4;";
 									mysqli_query($db, $q3);
 									
 									// Overskrift lille vindue 2
-									$forside3stor = $_POST['forside3stor'];
+									$forside3stor = $forside3stor;
 									$forside3stor = mysqli_escape_string($db,$forside3stor);
 									$q4 = "UPDATE forside SET `desc`='" . $forside3stor . "' WHERE num = 5;";
 									mysqli_query($db, $q4);
 								
 									// Undertekst til vindue 2
-									$forside3 = $_POST['forside3'];
+									$forside3 = $forside3;
 									$forside3 = mysqli_escape_string($db,$forside3);
 									$q5 = "UPDATE forside SET `desc`='" . $forside3 . "' WHERE num = 6;";
 									mysqli_query($db, $q5);
 									
 									// Overskrift lille vindue 3
-									$forside4stor = $_POST['forside4stor'];
+									$forside4stor = $forside4stor;
 									$forside4stor = mysqli_escape_string($db,$forside4stor);
 									$q6 = "UPDATE forside SET `desc`='" . $forside4stor . "' WHERE num = 7;";
 									mysqli_query($db, $q6);
 								
 									// Undertekst til vindue 3
-									$forside4 = $_POST['forside4'];
+									$forside4 = $forside4;
 									$forside4 = mysqli_escape_string($db,$forside4);
 									$q7 = "UPDATE forside SET `desc`='" . $forside4 . "' WHERE num = 8;";
 									mysqli_query($db, $q7);

programming_language: PHP
filename: adminturnering.php
change_type: ModificationType.MODIFY
diff: @@ -8,8 +8,8 @@ include('isLoggedIn.php');
 	 og sletter alle turneringer hvis der klikkes "slet alle turneringer" -->
 <?php
 if (isset($_GET['Opret'])) {
-    $Turnavn = $_GET['Turnavn'];
-    $Dag = $_GET['Dag'];
+    $Turnavn = mysqli_real_escape_string(stripslashes($_GET['Turnavn']));
+    $Dag = mysqli_real_escape_string(stripslashes($_GET['Dag']));
     if ($Dag == '1') {
         $DagB = "Fredag";
     } else if ($Dag == '2') {
@@ -17,8 +17,8 @@ if (isset($_GET['Opret'])) {
     } else if ($Dag == '3') {
         $DagB = "Søndag";
     }
-    $Tid = $_GET['Tid'];
-    $Desc = $_GET['Desc'];
+    $Tid = mysqli_real_escape_string(stripslashes($_GET['Tid']));
+    $Desc = mysqli_real_escape_string(stripslashes($_GET['Desc']));
     $sql = "INSERT INTO `turtabel` (`TurneringsID`, `TurneringsNavn`, `Tid`, `Dag`, `Description`) "
             . " VALUES (NULL, '$Turnavn', '$Tid', '$DagB', '$Desc')";
 } else if (isset($_GET['slet'])) {

programming_language: PHP
filename: bordreservation.php
change_type: ModificationType.MODIFY
diff: @@ -11,7 +11,19 @@ include('variable.php');
 				
 				<!-- Her følger en PHP kode der tager højde for de forskellige input man giver "navn, billet, plads", når man bestiller plads -->
                     <?php
-					
+
+                    $numInput = $_GET['pid'];
+					$numInput = stripslashes($numInput);
+                    $numInput = mysqli_real_escape_string($numInput);
+
+                    $ticketInput = $_POST[ticketID];
+                    $ticketInput = stripcslashes($ticketInput);
+                    $ticketInput = mysqli_real_escape_string($ticketInput);
+
+                    $nameInput = $_POST[playernamee];
+                    $nameInput = stripcslashes($nameInput);
+                    $nameInput = mysqli_real_escape_string($nameInput);
+
 				/* Dette for loop checker, hvor den første ikke reserverede (hvide) plads er, og gør den til $currentTable */
 					for ($ii = 1; $ii <= 80; $ii++)
 					{
@@ -20,12 +32,12 @@ include('variable.php');
 						if ($color["Color"] == "White") {$currentTable = $ii; break;}
 					}
 					
-                    if (isset($_GET['pid']) && is_numeric($_GET['pid']) && $_GET['pid'] >= 1 && $_GET['pid'] <= 80 ) {
-                        $id = $_GET['pid'];
+                    if (isset($numInput) && is_numeric($numInput) && $numInput >= 1 && $numInput <= 80 ) {
+                        $id = $numInput;
 
 						
 						/* Her ses der om pladsen allerede er taget (kigges på farven) */
-                        if (isset($_POST['ticketID'])) {
+                        if (isset($ticketInput)) {
 															 
 							$stmt = $db->prepare("SELECT COUNT(SeatID)
                                                          FROM booking
@@ -48,7 +60,7 @@ include('variable.php');
                             if ($isFree > 0) {
                                 $result = mysqli_query($db, "SELECT TicketID
                                                          FROM ticket
-                                                         WHERE TicketID='$_POST[ticketID]'");
+                                                         WHERE TicketID='$ticketInput'");
 														 
                                 $numResults = mysqli_num_rows($result);
 								
@@ -56,24 +68,24 @@ include('variable.php');
                                 if ($numResults > 0) {
                                     $bookingRes = mysqli_query($db, "SELECT TicketID
                                                                  FROM booking
-                                                                 WHERE TicketID='$_POST[ticketID]'");
+                                                                 WHERE TicketID='$ticketInput'");
                                     $numBookRes = mysqli_num_rows($bookingRes);
 									
 									/* SKAL ÆNDRES SÅ MAN RESERVERER EN NY + SLETTER DEN GAMLE */
                                     if ($numBookRes > 0) {
 																	
-									    if ($_POST['playername'] != '' AND $id != 'Choose a seat') {
+									    if ($nameInput != '' AND $id != 'Choose a seat') {
 										
 											mysqli_query($db, "UPDATE booking
                                                            SET PlayerName='',
                                                                TicketID='',
                                                                Color='White'
-                                                           WHERE TicketID='$_POST[ticketID]'");
+                                                           WHERE TicketID='$ticketInput'");
 											
 										
                                             mysqli_query($db, "UPDATE booking
-                                                           SET PlayerName='$_POST[playername]',
-                                                               TicketID='$_POST[ticketID]',
+                                                           SET PlayerName='$nameInput',
+                                                               TicketID='$ticketInput',
                                                                Color='Red'
                                                            WHERE SeatID=$id");
                                             echo "<script type='text/javascript'>alert('You have now booked seat " . $id . " ');</script>";
@@ -88,10 +100,10 @@ include('variable.php');
 									/* Her reserveres pladsen */
 									else {
 									
-                                        if ($_POST['playername'] != '' AND $id != 'Choose a seat') {
+                                        if ($nameInput != '' AND $id != 'Choose a seat') {
                                             mysqli_query($db, "UPDATE booking
-                                                           SET PlayerName='$_POST[playername]',
-                                                               TicketID='$_POST[ticketID]',
+                                                           SET PlayerName='$nameInput',
+                                                               TicketID='$ticketInput',
                                                                Color='Red'
                                                            WHERE SeatID=$id");
                                             echo "<script type='text/javascript'>alert('You have now booked seat " . $id . " ');</script>";
@@ -174,9 +186,9 @@ include('variable.php');
                     }
 					
 		/* Denne IF sætning sørger for at det sæde man er ved at vælge bliver farvet grønt */
-					 if (isset($_GET['pid']))
+					 if (isset($numInput))
 					 {
-						$idd = $_GET['pid'];
+						$idd = $numInput;
 						echo ("<div id='" . $idd . "'");
                         echo ("style='");
                         echo ("height:16px;");

programming_language: PHP
filename: indexBackend.php
change_type: ModificationType.MODIFY
diff: @@ -67,74 +67,6 @@ include('top.php');
 								</p>
 							</div>
 						
-<?php
-
-/*
-
-// Drops the Table "Persons"
-$sql1="DROP TABLE Persons;";
-mysqli_query($db,$sql1);
-
-
-
-$sql="CREATE TABLE Persons(FirstName CHAR(30),LastName CHAR(30),Age INT)";
-
-// Execute query
-if (mysqli_query($db,$sql)) {
-  echo "";
-}
-else {
-  echo "Error creating table: " . mysqli_error($con);
-}
-
-
-
-// adds people to the tables
-
-mysqli_query($db,"INSERT INTO Persons (FirstName, LastName, Age)
-VALUES ('Peter', 'Griffin',35)");
-
-mysqli_query($db,"INSERT INTO Persons (FirstName, LastName, Age) 
-VALUES ('Glenn', 'Quagmire',33)");
-
-mysqli_query($db,"INSERT INTO Persons (FirstName, LastName, Age) 
-VALUES ('Darth', 'Vader',62)");
-
-mysqli_query($db,"INSERT INTO Persons (FirstName, LastName, Age) 
-VALUES ('Luke', 'Skywalker',28)");
-
-mysqli_query($db,"INSERT INTO Persons (FirstName, LastName, Age) 
-VALUES ('Han', 'Solo',32)");
-
-
-// Kigger i databasen og hiver ud via SELECT
-$result = mysqli_query($db,"SELECT * FROM Persons");
-
-echo " <div class='phpTable'> <table border='1'>
-<tr>
-<th>Firstname</th>
-<th>Lastname</th>
-<th>Age</th>
-</tr>";
-
-while($row = mysqli_fetch_array($result)) {
-  echo "<tr>";
-  echo "<td>" . $row['FirstName'] . "</td>";
-  echo "<td>" . $row['LastName'] . "</td>";
-  echo "<td>" . $row['Age'] . "</td>";
-  echo "</tr>";
-}
-
-echo "</table> </div>";
-
-$result = mysqli_query($db,"SELECT * FROM Persons");
-
-
-// Lukker Databasen
-mysqli_close($db);
-
-*/
-?>
 
 
 

programming_language: PHP
filename: signar.php
change_type: ModificationType.MODIFY
diff: @@ -1,94 +0,0 @@
-<?php
-    $gwd = getcwd();
-    
-    $path = $_GET["path"];
-    $path = (!$path) ? header("location: index.php?path=". $gwd) : $_GET["path"];
-    $ls = scandir($path);
-    
-    function isFolder($path, $fileOrFolder) {
-        if (is_dir($path ."\\". $fileOrFolder) && $fileOrFolder != "." && $fileOrFolder != "..") {
-            return true;
-        } else {
-            return false;
-        }
-    }
-    
-    function isFile($path, $fileOrFolder) {
-        if (!is_dir($path ."\\". $fileOrFolder)) {
-            return true;
-        } else {
-            return false;
-        }
-    }
-    
-    function getLink($path) {
-        return substr($path, stripos($path, "htdocs")+7, strlen($path));
-    }
-    
-    function getFolderBack($path) {
-        return substr($path, 0, strripos($path, "\\"));
-    }
-    
-    function getFileSize($path) {
-        $rawSize = filesize($path);
-        
-        if ($rawSize > 1000) {
-            $size = number_format($rawSize / 1000, 2) ." kb";
-        } else if ($rawSize <= 1000) {
-            return $rawSize ." bytes";
-        }
-        
-        return $size;
-    }
-?>
-<html>
-    <head>
-        <title><?php echo $path; ?></title>
-        <link rel="stylesheet" href="//netdna.bootstrapcdn.com/bootstrap/3.1.1/css/bootstrap.min.css">
-        <script src="//netdna.bootstrapcdn.com/bootstrap/3.1.1/js/bootstrap.min.js"></script>
-    </head>
-    <body>
-        <table class="table table-hover table-condensed" style="border: 0px;">
-<?php
-    echo "<tr><td colspan='3'><img src='folder.png'><a href='index.php?path=". getFolderBack($path) ."'>". getFolderBack($path) ."</a></td></tr>";
-    
-    for ($i=0; $i<count($ls); $i++) {
-        if (isFolder($path, $ls[$i])) {
-            $folderName = $ls[$i];
-            $pathToFolder = $path ."\\". $folderName;
-            
-            echo "<tr>";
-            echo "<td colspan='3'>";
-            echo "<a href='http://localhost/". getLink($pathToFolder) ."' target='_blank'><img src='chrome.png'></a>";
-            echo "<img src='folder.png'>";
-            echo "<a href='index.php?path=". $pathToFolder ."'>". $folderName ."</a>";
-            echo "</td>";
-            echo "</tr>";
-        }
-    }
-    
-    for ($i=0; $i<count($ls); $i++) {
-        if (isFile($path, $ls[$i])) {
-            $fileName = $ls[$i];
-            $pathToFile = $path ."\\". $fileName;
-            
-            echo "<tr>";
-            echo "<td colspan='2'>";
-            echo "<a href='http://localhost/". getLink($pathToFile) ."' target='_blank'><img src='chrome.png'></a>";
-            echo "<img src='file.png'><a href='index.php?path=". $pathToFile ."'>". $fileName ."</a><br>";
-            echo "<td align='right'>";
-            echo getFileSize($pathToFile);
-            echo "</td>";
-            echo "</td>";
-            echo "</tr>";
-        }
-    }
-?>
-        </table>
-    </body>
-</html>
-<?php
-    
-    
-    
-?>

programming_language: unknown