starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2022-25372 (published 2022-02-20T20:15Z)

Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWNER in platform_windows.go.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-269
cwe_name: Improper Privilege Management
description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/pritunl/pritunl-client-electron
commit_details: repo_url: https://github.com/pritunl/pritunl-client-electron
author: Zachary Huff
author_date: 2022-02-17 18:47:14-05:00
msg: Update acl in service platform windows
repository: repo_url: https://github.com/pritunl/pritunl-client-electron
repo_name: pritunl/pritunl-client-electron
description: Pritunl OpenVPN client
repo_language: Go
owner: pritunl
file_changes: filename: platform_windows.go
change_type: ModificationType.MODIFY
diff: @@ -22,7 +22,6 @@ func MkdirSecure(pth string) (err error) {
 		pth,
 		true,
 		false,
-		acl.GrantName(windows.GENERIC_ALL, "CREATOR OWNER"),
 		acl.GrantName(windows.GENERIC_ALL, "SYSTEM"),
 		acl.GrantName(windows.GENERIC_ALL, "Administrators"),
 	)

programming_language: Go
CVE-2022-0767 (published 2022-03-07T07:15Z)

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.9, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/janeczku/calibre-web
commit_details: repo_url: https://github.com/janeczku/calibre-web
author: Ozzie Isaacs
author_date: 2022-02-26 08:05:35+01:00
msg: Don't allow redirects on cover uploads, catch more addresses which resolve to localhost
repository: repo_url: https://github.com/janeczku/calibre-web
repo_name: janeczku/calibre-web
description: :books: Web app for browsing, reading and downloading eBooks stored in a Calibre database
repo_language: Fluent
owner: janeczku
file_changes: filename: helper.py
change_type: ModificationType.MODIFY
diff: @@ -734,10 +734,10 @@ def save_cover_from_url(url, book_path):
         if not cli.allow_localhost:
             # 127.0.x.x, localhost, [::1], [::ffff:7f00:1]
             ip = socket.getaddrinfo(urlparse(url).hostname, 0)[0][4][0]
-            if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1":
+            if ip.startswith("127.") or ip.startswith('::ffff:7f') or ip == "::1" or ip == "0.0.0.0" or ip == "::":
                 log.error("Localhost was accessed for cover upload")
                 return False, _("You are not allowed to access localhost for cover uploads")
-        img = requests.get(url, timeout=(10, 200))      # ToDo: Error Handling
+        img = requests.get(url, timeout=(10, 200), allow_redirects=False)      # ToDo: Error Handling
         img.raise_for_status()
         return save_cover(img, book_path)
     except (socket.gaierror,

programming_language: Python
CVE-2017-8072 (published 2017-04-23T05:59Z)

The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-388
cwe_name: 7PK - Errors
description: This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Johan Hovold
author_date: 2017-01-30 11:26:39+01:00
msg: HID: cp2112: fix gpio-callback error handling

In case of a zero-length report, the gpio direction_input callback would
currently return success instead of an errno.

Fixes: 1ffb3c40ffb5 ("HID: cp2112: make transfer buffers DMA capable")
Cc: stable <stable@vger.kernel.org>     # 4.9
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: hid-cp2112.c
change_type: ModificationType.MODIFY
diff: @@ -213,7 +213,7 @@ static int cp2112_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 
 exit:
 	mutex_unlock(&dev->lock);
-	return ret <= 0 ? ret : -EIO;
+	return ret < 0 ? ret : -EIO;
 }
 
 static void cp2112_gpio_set(struct gpio_chip *chip, unsigned offset, int value)

programming_language: C
CVE-2013-2130 (published 2014-06-05T20:55Z)

ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) editnetwork, (2) editchan, (3) addchan, or (4) delchan page in modules/webadmin.cpp.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/znc/znc
commit_details: repo_url: https://github.com/znc/znc
author: Alexey Sokolov
author_date: 2013-05-27 23:48:23+04:00
msg: Fix NULL pointer dereference in webadmin.

Triggerable by any non-admin, if webadmin is loaded.

The only affected version is 1.0

Thanks to ChauffeR (Simone Esposito) for reporting this.
repository: repo_url: https://github.com/znc/znc
repo_name: znc/znc
description: Official repository for the ZNC IRC bouncer
repo_language: C++
owner: znc
file_changes: filename: webadmin.cpp
change_type: ModificationType.MODIFY
diff: @@ -426,7 +426,7 @@ public:
 			CIRCNetwork* pNetwork = SafeGetNetworkFromParam(WebSock);
 
 			// Admin||Self Check
-			if (!spSession->IsAdmin() && (!spSession->GetUser() || spSession->GetUser() != pNetwork->GetUser())) {
+			if (!spSession->IsAdmin() && (!spSession->GetUser() || !pNetwork || spSession->GetUser() != pNetwork->GetUser())) {
 				return false;
 			}
 
@@ -455,7 +455,7 @@ public:
 			CIRCNetwork* pNetwork = SafeGetNetworkFromParam(WebSock);
 
 			// Admin||Self Check
-			if (!spSession->IsAdmin() && (!spSession->GetUser() || spSession->GetUser() != pNetwork->GetUser())) {
+			if (!spSession->IsAdmin() && (!spSession->GetUser() || !pNetwork || spSession->GetUser() != pNetwork->GetUser())) {
 				return false;
 			}
 
@@ -479,7 +479,7 @@ public:
 			CIRCNetwork* pNetwork = SafeGetNetworkFromParam(WebSock);
 
 			// Admin||Self Check
-			if (!spSession->IsAdmin() && (!spSession->GetUser() || spSession->GetUser() != pNetwork->GetUser())) {
+			if (!spSession->IsAdmin() && (!spSession->GetUser() || !pNetwork || spSession->GetUser() != pNetwork->GetUser())) {
 				return false;
 			}
 
@@ -493,7 +493,7 @@ public:
 			CIRCNetwork* pNetwork = SafeGetNetworkFromParam(WebSock);
 
 			// Admin||Self Check
-			if (!spSession->IsAdmin() && (!spSession->GetUser() || spSession->GetUser() != pNetwork->GetUser())) {
+			if (!spSession->IsAdmin() && (!spSession->GetUser() || !pNetwork || spSession->GetUser() != pNetwork->GetUser())) {
 				return false;
 			}
 

programming_language: C++
CVE-2019-19078 (published 2019-11-18T06:15Z)

A memory leak in the ath10k_usb_hif_tx_sg() function in drivers/net/wireless/ath/ath10k/usb.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering usb_submit_urb() failures, aka CID-b8d17e7d93d2.

Severity: HIGH
CVSS v2 base score: 7.8 (AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-401
cwe_name: Missing Release of Memory after Effective Lifetime
description: The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
extended_description: This is often triggered by improper handling of malformed data or unexpectedly interrupted sessions.  In some languages, developers are responsible for tracking memory allocation and releasing the memory.  If there are no more pointers or references to the memory, then it can no longer be tracked and identified for release.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Navid Emamdoost
author_date: 2019-09-19 20:36:26-05:00
msg: ath10k: fix memory leak

In ath10k_usb_hif_tx_sg the allocated urb should be released if
usb_submit_urb fails.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: usb.c
change_type: ModificationType.MODIFY
diff: @@ -435,6 +435,7 @@ static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
 			ath10k_dbg(ar, ATH10K_DBG_USB_BULK,
 				   "usb bulk transmit failed: %d\n", ret);
 			usb_unanchor_urb(urb);
+			usb_free_urb(urb);
 			ret = -EINVAL;
 			goto err_free_urb_to_pipe;
 		}

programming_language: C
CVE-2020-23907 (published 2021-04-21T18:15Z)

An issue was discovered in retdec v3.3. In function canSplitFunctionOn() of ir_modifications.cpp, there is a possible out of bounds read due to a heap buffer overflow. The impact is: Deny of Service, Memory Disclosure, and Possible Code Execution.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/avast/retdec
commit_details: repo_url: https://github.com/avast/retdec
author: azhou
author_date: 2019-09-10 02:02:50+08:00
msg: Try to fix issue #637

Reference: https://github.com/avast/retdec/issues/637
repository: repo_url: https://github.com/avast/retdec
repo_name: avast/retdec
description: RetDec is a retargetable machine-code decompiler based on LLVM.
repo_language: C++
owner: avast
file_changes: filename: ir_modifications.cpp
change_type: ModificationType.MODIFY
diff: @@ -423,6 +423,9 @@ bool Decoder::canSplitFunctionOn(
 				continue;
 			}
 			auto up = fncStarts.upper_bound(bAddr);
+			if (up == fncStarts.begin()) {
+				return false;
+			}	
 			--up;
 			Address bFnc = *up;
 
@@ -442,6 +445,9 @@ bool Decoder::canSplitFunctionOn(
 					continue;
 				}
 				auto up = fncStarts.upper_bound(pAddr);
+				if (up == fncStarts.begin()) {
+					return false;
+				}
 				--up;
 				Address pFnc = *up;
 

programming_language: C++
CVE-2023-28114 (published 2023-03-22T19:15Z)

`cilium-cli` is the command line interface to install, manage, and troubleshoot Kubernetes clusters running Cilium. Prior to version 0.13.2,`cilium-cli`, when used to configure cluster mesh functionality, can remove the enforcement of user permissions on the `etcd` store used to mirror local cluster information to remote clusters. Users who have set up cluster meshes using the Cilium Helm chart are not affected by this issue.\n\nDue to an incorrect mount point specification, the settings specified by the `initContainer` that configures `etcd` users and their permissions are overwritten when using `cilium-cli` to configure a cluster mesh. An attacker who has already gained access to a valid key and certificate for an `etcd` cluster compromised in this manner could then modify state in that `etcd` cluster.\n\nThis issue is patched in `cilium-cli` 0.13.2. As a workaround, one may use Cilium's Helm charts to create their cluster.

CVSS v3 base score: 4.1, MEDIUM (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-280
cwe_name: Improper Handling of Insufficient Permissions or Privileges 
description: The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
extended_description: 
            
         
         
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/cilium/cilium-cli
commit_details: repo_url: https://github.com/cilium/cilium-cli
author: Marco Iorio
author_date: 2023-03-06 14:48:46+01:00
msg: clustermesh: correctly mount the etcd data dir in the init container

This commit fixes an incorrect volume mount specification for the init
container of the clustermesh-apiserver deployment created through
'cilium clustermesh enable', that caused the operations performed in the
init container itself to be disregarded.

Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
repository: repo_url: https://github.com/cilium/cilium-cli
repo_name: cilium/cilium-cli
description: CLI to install, manage & troubleshoot Kubernetes clusters running Cilium
repo_language: Go
owner: cilium
file_changes: filename: clustermesh.go
change_type: ModificationType.MODIFY
diff: @@ -320,7 +320,7 @@ func (k *K8sClusterMesh) generateDeployment(clustermeshApiserverArgs []string) *
 							VolumeMounts: []corev1.VolumeMount{
 								{
 									Name:      "etcd-data-dir",
-									MountPath: "etcd-data-dir",
+									MountPath: "/var/run/etcd",
 								},
 							},
 						},

programming_language: Go
CVE-2018-18445 (published 2018-10-17T19:29Z)

In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Jann Horn
author_date: 2018-10-05 18:17:59+02:00
msg: bpf: 32-bit RSH verification must truncate input before the ALU op

When I wrote commit 468f6eafa6c4 ("bpf: fix 32-bit ALU op verification"), I
assumed that, in order to emulate 64-bit arithmetic with 32-bit logic, it
is sufficient to just truncate the output to 32 bits; and so I just moved
the register size coercion that used to be at the start of the function to
the end of the function.

That assumption is true for almost every op, but not for 32-bit right
shifts, because those can propagate information towards the least
significant bit. Fix it by always truncating inputs for 32-bit ops to 32
bits.

Also get rid of the coerce_reg_to_size() after the ALU op, since that has
no effect.

Fixes: 468f6eafa6c4 ("bpf: fix 32-bit ALU op verification")
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: verifier.c
change_type: ModificationType.MODIFY
diff: @@ -2896,6 +2896,15 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
 	u64 umin_val, umax_val;
 	u64 insn_bitness = (BPF_CLASS(insn->code) == BPF_ALU64) ? 64 : 32;
 
+	if (insn_bitness == 32) {
+		/* Relevant for 32-bit RSH: Information can propagate towards
+		 * LSB, so it isn't sufficient to only truncate the output to
+		 * 32 bits.
+		 */
+		coerce_reg_to_size(dst_reg, 4);
+		coerce_reg_to_size(&src_reg, 4);
+	}
+
 	smin_val = src_reg.smin_value;
 	smax_val = src_reg.smax_value;
 	umin_val = src_reg.umin_value;
@@ -3131,7 +3140,6 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
 	if (BPF_CLASS(insn->code) != BPF_ALU64) {
 		/* 32-bit ALU ops are (32,32)->32 */
 		coerce_reg_to_size(dst_reg, 4);
-		coerce_reg_to_size(&src_reg, 4);
 	}
 
 	__reg_deduce_bounds(dst_reg);

programming_language: C
CVE-2021-3901 (published 2021-10-27T21:15Z)

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/firefly-iii/firefly-iii
commit_details: repo_url: https://github.com/firefly-iii/firefly-iii
author: James Cole
author_date: 2021-10-24 07:32:08+02:00
msg: Fix rescan
repository: repo_url: https://github.com/firefly-iii/firefly-iii
repo_name: firefly-iii/firefly-iii
description: Firefly III: a personal finances manager
repo_language: PHP
owner: firefly-iii
file_changes: filename: show.twig
change_type: ModificationType.MODIFY
diff: @@ -96,7 +96,13 @@
                     {% endif %}
                 </div>
                 <div class="box-footer">
-                    <p><a id="billButtons" href="{{ route('bills.rescan',object.data.id) }}" class="btn btn-default">{{ 'rescan_old'|_ }}</a></p>
+                    <form action="{{ route('bills.rescan',object.data.id) }}" method="post">
+                        <input type="hidden" name="_token" value="{{ csrf_token() }}"/>
+                        <p>
+                            <input type="submit" name="submit" value="{{ 'rescan_old'|_ }}" class="btn btn-default" />
+                        </p>
+                    </form>
+
                     <p><small class="text-muted">
                             {{ 'running_again_loss'|_ }}
                         </small>

programming_language: HTML
filename: web.php
change_type: ModificationType.MODIFY
diff: @@ -195,7 +195,7 @@ static function () {
     ['middleware' => 'user-full-auth', 'namespace' => 'FireflyIII\Http\Controllers', 'prefix' => 'bills', 'as' => 'bills.'],
     static function () {
         Route::get('', ['uses' => 'Bill\IndexController@index', 'as' => 'index']);
-        Route::get('rescan/{bill}', ['uses' => 'Bill\ShowController@rescan', 'as' => 'rescan']);
+        Route::post('rescan/{bill}', ['uses' => 'Bill\ShowController@rescan', 'as' => 'rescan']);
         Route::get('create', ['uses' => 'Bill\CreateController@create', 'as' => 'create']);
         Route::get('edit/{bill}', ['uses' => 'Bill\EditController@edit', 'as' => 'edit']);
         Route::get('delete/{bill}', ['uses' => 'Bill\DeleteController@delete', 'as' => 'delete']);

programming_language: PHP
CVE-2013-10017 (published 2023-02-04T00:15Z)

A vulnerability was found in fanzila WebFinance 0.5. It has been classified as critical. Affected is an unknown function of the file htdocs/admin/save_roles.php. The manipulation of the argument id leads to sql injection. The name of the patch is 6cfeb2f6b35c1b3a7320add07cd0493e4f752af3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-220056.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/fanzila/WebFinance
commit_details: repo_url: https://github.com/fanzila/WebFinance
author: Cyril Bouthors
author_date: 2013-09-18 15:13:13+02:00
msg: * htdocs/admin/save_roles.php: fixed SQL injection, yet again
repository: repo_url: https://github.com/fanzila/WebFinance
repo_name: fanzila/WebFinance
description: Web application to manage invoices and handle clients contacts: Python/Django front office, PHP back office, MySQL database
repo_language: PHP
owner: fanzila
file_changes: filename: save_roles.php
change_type: ModificationType.MODIFY
diff: @@ -33,6 +33,7 @@ require("../inc/main.php");
 must_login();
 
 if ($_GET['action'] == "delete") {
+  $_GET['id'] = mysql_real_escape_string($_GET['id']);
   mysql_query("DELETE FROM webfinance_roles WHERE id_role=".$_GET['id']);
   $_SESSION['message'] = _('Role deleted');
   header("Location: preferences.php?tab=Role");

programming_language: PHP