CVE-2015-10046 (published 2023-01-15T10:15Z)

A vulnerability has been found in lolfeedback and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The identifier of the patch is 6cf0b5f2228cd8765f734badd37910051000f2b2. It is recommended to apply a patch to fix this issue. The identifier VDB-218353 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/philipblaquiere/lolfeedback
commit_details: repo_url: https://github.com/philipblaquiere/lolfeedback
author: philipblaquiere
author_date: 2015-01-03 14:05:44-05:00
msg: prevent review sql injection, removed uness
repository: repo_url: https://github.com/philipblaquiere/lolfeedback
repo_name: philipblaquiere/lolfeedback
description: master repo
repo_language: HTML
owner: philipblaquiere
file_changes: filename: home.php
change_type: ModificationType.MODIFY
diff: @@ -10,6 +10,7 @@ class Home extends MY_Controller
 
 	public function index()
 	{
-		$this->view_wrapper('home');
+		$data['page'] = "home";
+		$this->view_wrapper('home', $data);
 	}
 }
\ No newline at end of file

programming_language: PHP
filename: register.php
change_type: ModificationType.MODIFY
diff: @@ -15,7 +15,8 @@ class Register extends MY_Controller
   public function index()
   {
     //Validation on input (requires that all fields exist)
-    $this->view_wrapper('register');
+    $data['page'] = "register";
+    $this->view_wrapper('register', $data);
   }
 
   public function password_match($pw1)
@@ -71,7 +72,8 @@ class Register extends MY_Controller
       $user['name'] = $_SESSION['player']['name'];
       $this->user_model->create($user);
       $this->system_message_model->set_message($user['name'] . ', you have successfully linked your League of Legends account! You can now post comments.', MESSAGE_INFO);
-      $this->view_wrapper('home');
+      $data['page'] = "home";
+      $this->view_wrapper('home', $data);
     }  
   }
 }
\ No newline at end of file

programming_language: PHP
filename: review.php
change_type: ModificationType.MODIFY
diff: @@ -56,4 +56,10 @@ class Review extends MY_Controller
 		}
 		$this->review_model->comment($comment);
 	}
+
+	public function get($id)
+	{
+		$data['reviews'] = $this->review_model->get($id);
+		$this->load->view('comments', $data);
+	}
 }
\ No newline at end of file

programming_language: PHP
filename: summoner.php
change_type: ModificationType.MODIFY
diff: @@ -46,6 +46,7 @@ class Summoner extends MY_Controller
 			else
 			{
 				$data['title'] = $summoner_name[$id];
+				$data['id'] = $id;
 			}
 			
 			$data['reviews'] = $this->review_model->get($id);
@@ -60,6 +61,8 @@ class Summoner extends MY_Controller
 			$data['stats'] = array_slice($stats, 0, 4);
 			$data['review_stats'] = array_slice($stats, 4, 2);
 			$data['sub_title'] = "Look below for game reviews";
+			$data['summonerid'] = $id;
+			$data['page'] = "summoner";
 		}
 		$this->view_wrapper('summoner', $data);
 	}

programming_language: PHP
filename: Recent_games.php
change_type: ModificationType.MODIFY
diff: @@ -97,7 +97,7 @@ class Recent_games
         array_push($playerids, $id);
         for ($i=0; $i < self::NUM_GAMES_RETURN; $i++)
         {
-            if(array_key_exists($i, $games[self::LOL_GAMES]))
+            if($games != null && array_key_exists($i, $games[self::LOL_GAMES]))
             {
                 $game = $games[self::LOL_GAMES][$i];
                 foreach ($game[self::LOL_PLAYERS] as $player)

programming_language: PHP
filename: review_model.php
change_type: ModificationType.MODIFY
diff: @@ -11,9 +11,9 @@ class Review_model extends CI_Model
 	public function create($review)
 	{
 		$sql = "INSERT INTO reviews (id, fromid, from_name, toid, gameid)
-		VALUES ('" . $review['id'] . "','" . $review['fromid'] . "','" . $review['from_name'] . "','" . $review['toid'] . "','" . $review['gameid'] . "')";
+		VALUES (?,?,?,?,?)";
 
-		$this->db1->query($sql);
+		$this->db1->query($sql, array($review['id'], $review['fromid'], $review['from_name'], $review['toid'], $review['gameid']));
 	}
 
 	public function update($review)
@@ -22,9 +22,9 @@ class Review_model extends CI_Model
 		$skill_value = $review['value'];
 		$reviewid = $review['id'];
 		$sql = "UPDATE reviews 
-				SET $skill = '$skill_value'
-				WHERE id = '$reviewid'";
-		$result = $this->db1->query($sql);
+				SET $skill = ?
+				WHERE id = ?";
+		$result = $this->db1->query($sql, array($skill_value, $reviewid));
 		return TRUE;
 	}
 
@@ -33,9 +33,9 @@ class Review_model extends CI_Model
 		$message = $comment['message'];
 		$reviewid = $comment['id'];
 		$sql = "UPDATE reviews
-				SET message = '$message'
-				WHERE id = '$reviewid'";
-		$result = $this->db1->query($sql);
+				SET message = ?
+				WHERE id = ?";
+		$result = $this->db1->query($sql, array($message, $reviewid));
 		return TRUE;
 	}
 
@@ -66,14 +66,14 @@ class Review_model extends CI_Model
 
 	public function get($toid)
 	{
-		$sql = "SELECT * FROM reviews 
-
+		$sql = "SELECT * FROM reviews
 				WHERE toid = '$toid'
 				AND (message IS NOT NULL
 				OR skill1 != 0
 				OR skill2 != 0
 				OR skill3 != 0
-				OR skill4 != 0)";
+				OR skill4 != 0)
+				ORDER BY created DESC";
 		$result = $this->db1->query($sql);
 		return $result->result_array();
 	}

programming_language: PHP
filename: comments.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,35 @@
+<div class="row">
+    <div class="reviews-title">
+      <p></p>
+    </div>
+  </div>
+  <div class="row">
+    <div class="col-md-7">
+    <div class="reviews-content">
+      <?php if(empty($reviews)) { ?>
+        <p>No reviews</p>
+        <?php } else { foreach ($reviews as $review) { ?>
+            <div class="review-header">
+              <p>
+                <a href="<?php echo site_url('summoner')."/".$review['fromid'] ?>"><?php echo $review['from_name'] ?></a>:
+                <?php if($review['skill1'] != 0) { ?>
+                Game-sense-<?php echo $review['skill1'] ?>
+                <?php } if($review['skill2'] != 0) { ?>
+                  Helpful-<?php echo $review['skill2'] ?>
+                <?php } if($review['skill3'] != 0) { ?>
+                  Skillful-<?php echo $review['skill4'] ?>
+                <?php } if($review['skill4'] != 0) { ?>
+                  Delivery-<?php echo $review['skill4'] ?>
+                <?php } ?>
+                <?php echo $review['created'] ?>
+              </p>
+            </div>
+            <div class="review-body">
+              <?php if($review['message'] != NULL) { ?>
+              <p><?php echo $review['message']?></p>
+              <?php } ?>
+            </div>
+        <?php } } ?>
+      </div>
+    </div>
+  </div>
\ No newline at end of file

programming_language: PHP
filename: footer.php
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,5 @@
 			<!-- Content-->
-  			</div><!-- Container -->
-  		</div><!-- Wrap -->
+  		</div><!-- Container -->
   		<div class="footer">
 		    <div class="copyright">Copyright &copy; <?php echo strftime('%Y'); ?></div>
 		</div>

programming_language: PHP
filename: header.php
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,6 @@
   <!--<link href="<?php echo base_url('assets/css/fbscript.css') ?>" rel="stylesheet" />-->
 </head>
 
-<body>
-  <div id="wrap">
-  <!-- Content -->
+<body <?php if($page == "summoner") { ?>id="<?php echo $summonerid ?>" <?php } ?> class="<?php echo $page ?>">
+  <!--   -->
   
\ No newline at end of file

programming_language: PHP
filename: recent_games.php
change_type: ModificationType.MODIFY
diff: @@ -1,48 +0,0 @@
-<?php if(empty($games)) { ?>
-<span class="open_sans">No matches have been played</span>
-<?php } ?>
-<?php foreach ($games as $game) { ?>
-
-<div class="lol-match row">
-	<div class="col-md-9">
-		<table class="table table-condensed">
-			<th class="col-md-1"/>
-			<th class="col-md-3"></th>
-			<th>Player</th>
-			<?php foreach ($game['100'] as $player) { ?>
-				<tr>
-					<td>
-						<?php if(isset($player['championSprite'])) { ?>
-						<img src="<?php echo $player['championSprite'] ?>" class="img-responsive" alt="Responsive image">
-						<?php } ?>
-					</td>
-					<td >
-						<div class="lol-match-player-name">
-							<strong><?php echo $player['name'] ?></strong>
-						</div>
-					</td>
-				</tr>
-			<?php } ?>
-		</table>
-		<table class="table table-condensed">
-			<th class="col-md-1"/>
-			<th class="col-md-3"></th>
-			<th>Player</th>
-			<?php foreach ($game['200'] as $player) { ?>
-				<tr>
-					<td>
-						<?php if(isset($player['championSprite'])) { ?>
-						<img src="<?php echo $player['championSprite'] ?>" class="img-responsive" alt="Responsive image">
-						<?php } ?>
-					</td>
-					<td >
-						<div class="lol-match-player-name">
-							<strong><?php echo $player['name'] ?></strong>
-						</div>
-					</td>
-				</tr>
-			<?php } ?>
-		</table>
-	</div>
-</div>
-<?php } ?>
\ No newline at end of file

programming_language: unknown
filename: register_lol.php
change_type: ModificationType.DELETE
diff: @@ -1,34 +0,0 @@
-<div class="page-header">
-  <h1>Account Registration - League of Legends</h1>
-  <h4><small>To begin linking your League of Legends account to our website, start by entering your League of Legends summoner name. Only one can be linked to an account at any given time. FYI: We'll never ask you for any League of Legends password.</small></h4>
-</div>
-
-<h2>Step 1 : Enter Summoner Name</h3>
-<!-- Ajax Call -> controllers/ajax/authenticate_summoner -->
-<?php echo form_open('',array('class' => 'form-horizontal padded_10', 'id' => 'lolSummonerRegistrationForm')); ?>
-  <div class="form-group">
-    <?php echo form_label('Summoner Name', 'summonername', array('class' => 'col-sm-2 control-label')); ?>
-    <div class="col-sm-10">
-      <div class="input-group">
-        <div class="input-group-btn">
-          <button type="button" class="btn btn-default dropdown-toggle" id="region" data-toggle="dropdown">Region <span class="caret"></span></button>
-          <ul class="dropdown-menu region-list">
-            <li><a href="#">NA</a></li>
-          </ul>
-        </div><!-- /btn-group -->
-        <?php echo form_input(array('name' => 'summonername','id' => 'summonername', 'class' => 'form-control', 'placeholder' => 'Summoner Name')); ?>
-      </div><!-- /input-group -->
-    </div>
-  </div>
-  <div class="form-group">
-    <div class="col-sm-1 col-sm-offset-3">
-      <?php echo form_submit('submit', 'Find', "class='btn btn-default'"); ?>
-    </div>
-    <div class="col-sm-7" id="summoner_validation_error">
-    </div>
-  </div>
-<?php echo form_close(); ?>
-
-<div id="authenticate_runepage_page">
-  <!-- Validation Content -->
-</div>

programming_language: unknown
filename: search.php
change_type: ModificationType.DELETE
diff: @@ -1,14 +0,0 @@
-<div class="row">
-  <div class="col-md-4"></div>
-  <div class="col-md-4">
-  	<?php echo form_open('search', array('class' => 'form-horizontal', 'id' => 'search_summoner')); ?>
-  		<div class="input-group">
-		      <?php echo form_input(array('name' => 'search', 'class' => 'form-control', 'placeholder' => 'Search Summoner', 'id' => 'search_textbox')); ?>
-        <span class="input-group-btn">
-          <button type="submit" class="btn btn-default">Search</button>
-        </span>
-		  </div>
-	<?php echo form_close(); ?>
-  </div>
-  <div class="col-md-4"></div>
-</div>

programming_language: unknown
filename: summoner.php
change_type: ModificationType.MODIFY
diff: @@ -43,7 +43,7 @@
   <div class="col-md-4 col-md-offset-4"><span class="open_sans"></span></div>
 </div>
 <?php } else { ?>
-<div class="summoner-games">
+<div id="sg_<?php echo $id ?>" class="summoner-games">
   <div class="row">
     <div class="col-md-7">
       <div class="panel-group" id="accordion" role="tablist" aria-multiselectable="true">
@@ -124,42 +124,8 @@
 </div>
 <?php } ?>
 
-<div class="summoner-reviews">
-  <div class="row">
-    <div class="reviews-title">
-      <p></p>
-    </div>
-  </div>
-  <div class="row">
-    <div class="col-md-7">
-    <div class="reviews-content">
-      <?php if(empty($reviews)) { ?>
-        <p>No reviews left for <?php echo $title ?></p>
-        <?php } else { foreach ($reviews as $review) { ?>
-            <div class="review-header">
-              <p>
-                <a href="<?php echo site_url('summoner')."/".$review['fromid'] ?>"><?php echo $review['from_name'] ?></a>:
-                <?php if($review['skill1'] != 0) { ?>.
-                  Game-sense-<?php echo $review['skill1'] ?>
-                <?php } if($review['skill2'] != 0) { ?>
-                  Helpful-<?php echo $review['skill2'] ?>
-                <?php } if($review['skill3'] != 0) { ?>
-                  Skillful-<?php echo $review['skill4'] ?>
-                <?php } if($review['skill4'] != 0) { ?>
-                  Delivery-<?php echo $review['skill4'] ?>
-                <?php } ?>
-                <?php echo $review['created'] ?>
-              </p>
-            </div>
-            <div class="review-body">
-              <?php if($review['message'] != NULL) { ?>
-              <p><?php echo $review['message']?></p>
-              <?php } ?>
-            </div>
-        <?php } } ?>
-      </div>
-    </div>
-  </div>
+<div id="sr_<?php echo $id ?>" class="summoner-reviews">
+
 </div>
 
 

programming_language: PHP
filename: custom.css
change_type: ModificationType.MODIFY
diff: @@ -226,6 +226,10 @@
 }
 .review-header{
 }
+.review-body{
+  margin-top: -5px;
+  padding-bottom: 5px;
+}
 ul
 {
     list-style-type: none;
@@ -237,6 +241,7 @@ ul
   padding-right: 15px;
   max-width: 400px;
 }
+
 .summoner-games{
 }
 .top-buffer { margin-top:20px; }

programming_language: CSS
filename: custom.js
change_type: ModificationType.MODIFY
diff: @@ -104,17 +104,6 @@ $(".region-list li a").click(function(event) {
     $(this).parents('.input-group-btn').find('.dropdown-toggle').html(selText + '  <span class="caret"></span> ');
 });
 
-function reloadLoLRegister(message) {
-    alert("in reload");
-    $.ajax({
-        url: '/LoLRep/add_esport/register_LoL',
-        type: "post",
-        data: {},
-        success: function(data){
-            $("#authenticate_runepage_page").html(message);
-        }
-    });
-}
 
 function switchButtonToRegister()
 {
@@ -307,3 +296,25 @@ $(document).on('change', ".skill-radio", function() {
     });
 });
 
+$(document).ready(function() {
+    if($('body').is('.summoner')){
+
+        var summonerId = document.getElementsByTagName("body")[0].id
+        $("#sr_"+summonerId).html('<div class="row"><div class="col-md-1 col-md-offset-5"><div class="spinner"><i class="fa-li fa fa-spinner fa-spin fa-2x"></i></div></div></div>');
+
+        $.ajax({
+        url: "/perfect/index.php/review/get/"+summonerId,
+        type: 'POST',
+        data: {},
+        success: function(data){
+            $("#sr_"+summonerId).html();
+            $("#sr_"+summonerId).html(data);
+        },
+        error:function(jqXHR, textStatus, errorThrown){
+            $("#"+buttonId).html('An error has occured creating the review:' + textStatus +errorThrown);
+            return;
+        }
+    });
+  }
+});
+

programming_language: JavaScript