CVE-2023-4188 (published 2023-08-05T20:15Z)

 SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/instantsoft/icms2
commit_details: repo_url: https://github.com/instantsoft/icms2
author: fuzegit
author_date: 2023-08-05 15:30:12+03:00
msg: Vulnerabilities fixed, thanks to huntr.dev
repository: repo_url: https://github.com/instantsoft/icms2
repo_name: instantsoft/icms2
description: Self-hosted Site Management System
repo_language: PHP
owner: instantsoft
file_changes: filename: menu_tree_ajax.php
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,7 @@ class actionAdminMenuTreeAjax extends cmsAction {
         if ($items) {
             foreach ($items as $item) {
                 $tree_nodes[] = [
-                    'title'  => $item['title'],
+                    'title'  => html($item['title'], false),
                     'key'    => "{$menu_id}.{$item['id']}",
                     'isLazy' => ($item['childs_count'] > 0)
                 ];

programming_language: PHP
filename: autocomplete.php
change_type: ModificationType.MODIFY
diff: @@ -12,13 +12,13 @@ class actionTagsAutocomplete extends cmsAction {
 
         $result = [];
 
-        $term = $this->request->get('term', '');
+        $term = strip_tags($this->request->get('term', ''));
         if (!$term) {
             return $this->cms_template->renderJSON($result);
         }
 
         $tags = $this->model->filterLike('tag', "%{$term}%")->
-                select("(LEFT(`tag`, " . mb_strlen($term) . ") = '{$term}')", 'tag_order')->
+                select("(LEFT(`tag`, " . mb_strlen($term) . ") = '".$this->model->db->escape($term)."')", 'tag_order')->
                 orderByList([
                     ['by' => 'tag_order', 'to' => 'desc', 'strict' => true],
                     ['by' => 'tag', 'to' => 'asc']

programming_language: PHP
filename: user.php
change_type: ModificationType.MODIFY
diff: @@ -277,13 +277,15 @@ class cmsUser {
      * @param boolean $complete_login
      * @return integer|array
      */
-    public static function login($email, $password, $remember = false, $complete_login = true) {
+    public static function login($email, $password, $remember = false, $complete_login = true, $model = null) {
 
         if (!$email || !$password) {
             return 0;
         }
 
-        $model = cmsCore::getModel('users');
+        if($model === null) {
+            $model = cmsCore::getModel('users');
+        }
 
         $user = $model->getUserByAuth($email, $password);
 

programming_language: PHP
filename: string.php
change_type: ModificationType.MODIFY
diff: @@ -140,6 +140,15 @@ class fieldString extends cmsFormField {
         }
 
         if ($this->getProperty('is_clean_disable') === true) {
+
+            // Разрешены HTML теги, - прогоняем через типограф
+            $value = cmsEventsManager::hook('html_filter', [
+                'text'                => $value,
+                'is_auto_br'          => false,
+                'build_smiles'        => false,
+                'build_redirect_link' => false
+            ]);
+
             return trim($value, " \0");
         }
 

programming_language: PHP
filename: template.helper.php
change_type: ModificationType.MODIFY
diff: @@ -63,7 +63,7 @@ function html_pagebar($page, $perpage, $total, $base_uri = false, $query = [], $
  */
 function html_input($type = 'text', $name = '', $value = '', $attributes = []) {
 
-    if ($type === 'password') {
+    if ($type === 'password' && empty($attributes['autocomplete'])) {
         $attributes['autocomplete'] = 'off';
     }
     $attributes['type']  = $type;

programming_language: PHP
filename: form.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@
     <?php $this->toolbar('menu-toolbar'); ?>
 <?php } ?>
 
-<form id="<?php html($attributes['form_id']); ?>" action="<?php echo $attributes['action']; ?>"
+<form id="<?php html($attributes['form_id']); ?>" action="<?php html($attributes['action']); ?>"
       method="<?php echo $attributes['method']; ?>"
       class="<?php html($attributes['form_class']); ?><?php if ($this->controller->request->isAjax()){ ?> ajax-form<?php } ?>"
       enctype="multipart/form-data"

programming_language: PHP
filename: grid-perms.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@
     <?php $this->toolbar('menu-toolbar'); ?>
 <?php } ?>
 
-<form action="<?php echo $submit_url; ?>" method="post">
+<form action="<?php html($submit_url); ?>" method="post">
 
     <div class="datagrid_wrapper perms_grid table-responsive dataTables_wrapper dt-bootstrap4">
         <table id="datagrid" class="datagrid table table-striped table-bordered dataTable bg-white">

programming_language: PHP
filename: menu.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,7 @@
             <ul id="treeData" class="skeleton-tree">
                 <?php foreach ($menus as $id => $menu) { ?>
                     <li id="<?php echo $menu['id'];?>.0" class="lazy folder">
-                        <?php echo $menu['title']; ?>
+                        <?php html($menu['title']); ?>
                     </li>
                 <?php } ?>
             </ul>

programming_language: PHP
filename: confirm.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 <div class="modal_padding">
     <h3><?php echo $confirm_title; ?></h3>
-    <form action="<?php echo $confirm_action; ?>" method="post" onsubmit="$(this).find('.button-submit').addClass('disabled is-busy');">
+    <form action="<?php html($confirm_action); ?>" method="post" onsubmit="$(this).find('.button-submit').addClass('disabled is-busy');">
         <?php echo html_csrf_token(); ?>
         <?php echo html_input('hidden', 'back', $this->controller->request->get('back', '')); ?>
         <?php echo html_submit(LANG_CONFIRM); ?>

programming_language: PHP
filename: filter-panel.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -10,7 +10,7 @@
 		<div class="filter-close">
             <a href="javascript:toggleFilter();"><span><?php echo LANG_CLOSE; ?></span></a>
         </div>
-        <form action="<?php echo $form_url; ?>" method="get" id="<?php echo $form_id; ?>" accept-charset="utf-8">
+        <form action="<?php html($form_url); ?>" method="get" id="<?php echo $form_id; ?>" accept-charset="utf-8">
             <?php echo html_input('hidden', 'page', 1); ?>
             <?php if(!empty($ext_hidden_params)){ ?>
                 <?php foreach($ext_hidden_params as $fname => $fvalue){ ?>

programming_language: PHP
filename: form.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,7 @@
     </div>
 <?php } ?>
 
-<form id="<?php html($attributes['form_id']); ?>" action="<?php echo $attributes['action']; ?>"
+<form id="<?php html($attributes['form_id']); ?>" action="<?php html($attributes['action']); ?>"
       method="<?php echo $attributes['method']; ?>"
       <?php if ($this->controller->request->isAjax()){ ?>
         class="modal"

programming_language: PHP
filename: grid-perms.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,7 @@
 <?php } ?>
 
 
-<form action="<?php echo $submit_url; ?>" method="post">
+<form action="<?php html($submit_url); ?>" method="post">
 
     <div class="datagrid_wrapper perms_grid">
         <table id="datagrid" class="datagrid" cellpadding="0" cellspacing="0" border="0">

programming_language: PHP
filename: filter-panel.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -16,7 +16,7 @@ $form_url_sep = strpos($form_url, '?') === false ? '?' : '&';
         <button type="button" class="close position-absolute icms-filter-link__close" title="<?php echo LANG_CLOSE; ?>">
             <span>&times;</span>
         </button>
-        <form action="<?php echo $form_url; ?>" method="get" id="<?php echo $form_id; ?>" accept-charset="utf-8">
+        <form action="<?php html($form_url); ?>" method="get" id="<?php html($form_id); ?>" accept-charset="utf-8">
             <?php echo html_input('hidden', 'page', 1); ?>
             <?php if(!empty($ext_hidden_params)){ ?>
                 <?php foreach($ext_hidden_params as $fname => $fvalue){ ?>

programming_language: PHP
filename: form.tpl.php
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
     <?php $this->toolbar('menu-toolbar'); ?>
 <?php } ?>
 
-<form id="<?php html($attributes['form_id']); ?>" action="<?php echo $attributes['action']; ?>"
+<form id="<?php html($attributes['form_id']); ?>" action="<?php html($attributes['action']); ?>"
       method="<?php echo $attributes['method']; ?>"
       class="<?php html($attributes['form_class']); ?><?php if ($this->controller->request->isAjax()){ ?> ajax-form<?php } ?>"
       enctype="multipart/form-data"

programming_language: PHP