CVE-2014-1401 (published 2014-02-11T17:55Z)

Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/auracms/AuraCMS
commit_details: repo_url: https://github.com/auracms/AuraCMS
author: AuraCMS
author_date: 2014-01-31 10:54:24+07:00
msg: Update VCounter

Update VCounter
repository: repo_url: https://github.com/auracms/AuraCMS
repo_name: auracms/AuraCMS
description: Indonesia Content Management System
repo_language: PHP
owner: auracms
file_changes: filename: vcounter.php
change_type: ModificationType.MODIFY
diff: @@ -27,29 +27,29 @@
 		function ipCheck() {
 
 			if (getenv('HTTP_CLIENT_IP')) {
-				$ip = getenv('HTTP_CLIENT_IP');
+				$ip = mysql_real_escape_string(getenv('HTTP_CLIENT_IP'));
 			}
 			elseif (getenv('HTTP_X_FORWARDED_FOR')) {
-				$ip = getenv('HTTP_X_FORWARDED_FOR');
+				$ip = mysql_real_escape_string(getenv('HTTP_X_FORWARDED_FOR'));
 			}
 			elseif (getenv('HTTP_X_FORWARDED')) {
-				$ip = getenv('HTTP_X_FORWARDED');
+				$ip = mysql_real_escape_string(getenv('HTTP_X_FORWARDED'));
 			}
 			elseif (getenv('HTTP_FORWARDED_FOR')) {
-				$ip = getenv('HTTP_FORWARDED_FOR');
+				$ip = mysql_real_escape_string(getenv('HTTP_FORWARDED_FOR'));
 			}
 			elseif (getenv('HTTP_FORWARDED')) {
-				$ip = getenv('HTTP_FORWARDED');
+				$ip = mysql_real_escape_string(getenv('HTTP_FORWARDED'));
 			}
 			else {
-				$ip = $_SERVER['REMOTE_ADDR'];
+				$ip = mysql_real_escape_string($_SERVER['REMOTE_ADDR']);
 			}
 			return $ip;
 		}
 		
 		function new_user() {
 			global $db;
-			$insert = $db->sql_query("INSERT INTO `mod_useronline` (`timestamp`, `ip`) VALUES ('mysql_real_escape_string($this->timestamp)', 'mysql_real_escape_string($this->ip)')");
+			$insert = $db->sql_query("INSERT INTO `mod_useronline` (`timestamp`, `ip`) VALUES ('$this->timestamp', '$this->ip')");
 			if (!$insert) {
 				$this->error[$this->i] = "Unable to record new visitor\r\n";			
 				$this->i ++;
@@ -120,7 +120,7 @@
 
 	$yesterdaystart	 =	$daystart - (24*60*60);
 	$now			 =	time();
-	$ip				 =	getIP();
+	$ip				 =	mysql_real_escape_string(getIP());
 	
 
 	$r	= mysql_query("SELECT MAX( id ) AS total FROM `mod_visitcounter`");
@@ -140,12 +140,12 @@
 		//$query		 =  mysql_query ("DELETE FROM `mod_visitcounter` WHERE `id`<'$temp'");
 	}
 	
-	$item	=	mysql_fetch_assoc(mysql_query ("SELECT COUNT(*) AS `total` FROM `mod_visitcounter` WHERE `ip`='mysql_real_escape_string($ip)' AND (tm+'$locktime')>'$now'"));
+	$item	=	mysql_fetch_assoc(mysql_query ("SELECT COUNT(*) AS `total` FROM `mod_visitcounter` WHERE `ip`='$ip' AND (tm+'$locktime')>'$now'"));
 	$items	=	$item['total'];
 	
 	if (empty($items))
 	{
-		mysql_query ("INSERT INTO `mod_visitcounter` (`id`, `tm`, `ip`) VALUES ('', '$now', 'mysql_real_escape_string($ip)')");
+		mysql_query ("INSERT INTO `mod_visitcounter` (`id`, `tm`, `ip`) VALUES ('', '$now', '$ip')");
 	}
 	
 	$n				 = 	$all_visitors;

programming_language: PHP
repo_url: https://github.com/auracms/AuraCMS
commit_details: repo_url: https://github.com/auracms/AuraCMS
author: AuraCMS
author_date: 2014-01-14 11:02:30+07:00
msg: AuraCMS

Update Vulnerability SQL Injection in content.php
repository: repo_url: https://github.com/auracms/AuraCMS
repo_name: auracms/AuraCMS
description: Indonesia Content Management System
repo_language: PHP
owner: auracms
file_changes: filename: content.php
change_type: ModificationType.MODIFY
diff: @@ -88,7 +88,7 @@ if (!defined('INDEX')) {
 		<h2>Pencarian Berita</h2>
 		<div class="border" style="text-align:center;"><img src="mod/content/images/banner_searching_data.gif" alt="Searching Data" /></div>';
 		
-		$search	= !isset($_GET['search']) ? cleanText($_POST['search']) : cleanText($_GET['search']);
+		$search	= !isset($_GET['search']) ? mysqli_real_escape_string(cleanText($_POST['search'])) : mysqli_real_escape_string(cleanText($_GET['search']));
 		
 		if(!$search){
 			$tengah .= '<div class="error">Maaf Anda Belum Memasukkan Kata Pencarian</div>';

programming_language: PHP