CVE-2015-10045 (published 2023-01-15T10:15Z)

A vulnerability, which was classified as critical, was found in tutrantta project_todolist. Affected is the function getAffectedRows/where/insert/update in the library library/Database.php. The manipulation leads to sql injection. The name of the patch is 194a0411bbe11aa4813f13c66b9e8ea403539141. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218352.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/tutrantta/project_todolist
commit_details: repo_url: https://github.com/tutrantta/project_todolist
author: gmtranthanhtu
author_date: 2015-01-13 23:23:09+07:00
msg: add SQL injection preventor
repository: repo_url: https://github.com/tutrantta/project_todolist
repo_name: tutrantta/project_todolist
repo_language: PHP
owner: tutrantta
file_changes: filename: Database.php
change_type: ModificationType.MODIFY
diff: @@ -22,6 +22,10 @@ class Database
 		return mysqli_affected_rows($this->connection);
 	}
 
+	function sqlInjectionPrevent($value) {
+		return mysqli_real_escape_string($this->connection, $value);
+	}
+
 	function query($sql) {
 		$queryData = $this->connection->query($sql);
 		if(!$this->getAffectedRows()) return false;
@@ -40,7 +44,7 @@ class Database
 		if(count($where)) {
 			$arrTempWhere = array();
 			foreach($where as $key => $value) {
-				if(is_string($value)) $arrTempWhere[] = '' . $key . " = '" . $value . "'";
+				if(is_string($value)) $arrTempWhere[] = '' . $key . " = '" . $this->sqlInjectionPrevent($value) . "'";
 				else $arrTempWhere[] = '' . $key . " = " . $value;
 			}
 			$strWhere = implode(' AND ', $arrTempWhere);
@@ -55,6 +59,7 @@ class Database
 		if($columns === array()) $sql .= '*';
 		else $sql .= implode(',', $columns);
 		$sql .= ' FROM ' . $table . ' ' . $this->where($where);
+		var_dump($sql);
 		return $this->query($sql);
 	}
 
@@ -65,7 +70,7 @@ class Database
 		$arrValues = array();
 		foreach($values as $key => $value) {
 			$arrKeys[] = $key;
-			if(is_string($value)) $arrValues[] = " '$value' ";
+			if(is_string($value)) $arrValues[] = " '" . $this->sqlInjectionPrevent($value) . "' ";
 			else $arrValues[]  = "$value";
 		}
 		$sql .= implode(',', $arrKeys) . ') VALUES (' . implode(',', $arrValues) . ')';
@@ -83,7 +88,7 @@ class Database
 	{
 		$arrTempValue = array();
 		foreach($values as $key => $value) {
-			if(is_string($value)) $arrTempValue[] = "$key = '$value' ";
+			if(is_string($value)) $arrTempValue[] = "$key = '" . $this->sqlInjectionPrevent($value) . "' ";
 			else $arrTempValue[]  = "$key = $value";
 		}
 		$strValue = implode(',', $arrTempValue);

programming_language: PHP