CVE-2022-2067 (published 2022-06-13T13:15Z)

SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/francoisjacquet/rosariosis
commit_details: repo_url: https://github.com/francoisjacquet/rosariosis
author: François Jacquet
author_date: 2022-04-25 14:02:16+02:00
msg: Fix SQL injection escape DB identifier
repository: repo_url: https://github.com/francoisjacquet/rosariosis
repo_name: francoisjacquet/rosariosis
description: RosarioSIS Student Information System for school management.
repo_language: PHP
owner: francoisjacquet
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -53,6 +53,7 @@ Changes in 9.0
 - Add AttrEscape() function in Inputs.php
 - Use AttrEscape() instead of htmlspecialchars(), program wide
 - Maintain Advanced search when editing Timeframe in Percent.php
+- Fix SQL injection escape DB identifier in RegistrationSave.fnc.php, Calendar.php, MarkingPeriods.php, SchoolFields.php, AddressFields.php, PeopleFields.php, StudentFields.php & UserFields.php
 
 Changes in 8.9.4
 ----------------

programming_language: Markdown
filename: RegistrationSave.fnc.php
change_type: ModificationType.MODIFY
diff: @@ -407,7 +407,7 @@ function RegistrationSaveContactNameFields( $config, $values )
 			if ( ! empty( $value )
 				|| $value == '0' )
 			{
-				$fields .= $column . ',';
+				$fields .= DBEscapeIdentifier( $column ) . ',';
 
 				$values_sql .= "'" . $value . "',";
 			}

programming_language: PHP
filename: Calendar.php
change_type: ModificationType.MODIFY
diff: @@ -500,7 +500,7 @@ if ( $_REQUEST['modfunc'] === 'detail' )
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 							$values .= "'" . $value . "',";
 							$go = true;
 						}

programming_language: PHP
filename: MarkingPeriods.php
change_type: ModificationType.MODIFY
diff: @@ -204,7 +204,7 @@ if ( ! empty( $_POST['tables'] )
 				if ( ! empty( $value )
 					|| $value === '0' )
 				{
-					$fields .= $column . ',';
+					$fields .= DBEscapeIdentifier( $column ) . ',';
 
 					$values .= "'" . $value . "',";
 

programming_language: PHP
filename: SchoolFields.php
change_type: ModificationType.MODIFY
diff: @@ -73,7 +73,7 @@ if ( isset( $_POST['tables'] )
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 
 							$values .= "'" . $value . "',";
 

programming_language: PHP
filename: AddressFields.php
change_type: ModificationType.MODIFY
diff: @@ -91,7 +91,7 @@ if ( isset( $_POST['tables'] )
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 
 							$values .= "'" . $value . "',";
 

programming_language: PHP
filename: PeopleFields.php
change_type: ModificationType.MODIFY
diff: @@ -91,7 +91,7 @@ if ( isset( $_POST['tables'] )
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 
 							$values .= "'" . $value . "',";
 

programming_language: PHP
filename: StudentFields.php
change_type: ModificationType.MODIFY
diff: @@ -125,7 +125,7 @@ if ( isset( $_POST['tables'] )
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 
 							$values .= "'" . $value . "',";
 

programming_language: PHP
filename: UserFields.php
change_type: ModificationType.MODIFY
diff: @@ -134,7 +134,7 @@ if ( isset( $_POST['tables'] )
 						if ( ! empty( $value )
 							|| $value == '0' )
 						{
-							$fields .= $column . ',';
+							$fields .= DBEscapeIdentifier( $column ) . ',';
 
 							$values .= "'" . $value . "',";
 

programming_language: PHP