Security advisory GHSA-5v44-7647-xfw9: Blind SQL injection in PrestaShop productcomments module
Package: prestashop/productcomments (composer), vulnerable version: v4.2.0, fixed in: 4.2.1
CWE: CWE-89
Files changed by the fix:
controllers/front/CommentGrade.php
controllers/front/ListComments.php
productcomments.php
src/Repository/ProductCommentRepository.php

Fix diff:
diff --git a/controllers/front/CommentGrade.php b/controllers/front/CommentGrade.php
index a821d426..e9cb4940 100644
--- a/controllers/front/CommentGrade.php
+++ b/controllers/front/CommentGrade.php
@@ -38,6 +38,8 @@ public function display()
             return $this->ajaxRender(null);
         }
 
+        $idProducts = array_unique(array_map('intval', $idProducts));
+
         $productCommentRepository = $this->context->controller->getContainer()->get('product_comment_repository');
 
         $productsCommentsNb = $productCommentRepository->getCommentsNumberForProducts($idProducts, Configuration::get('PRODUCT_COMMENTS_MODERATE'));
diff --git a/controllers/front/ListComments.php b/controllers/front/ListComments.php
index f533dfff..04d8b764 100644
--- a/controllers/front/ListComments.php
+++ b/controllers/front/ListComments.php
@@ -29,8 +29,8 @@ class ProductCommentsListCommentsModuleFrontController extends ModuleFrontContro
 {
     public function display()
     {
-        $idProduct = Tools::getValue('id_product');
-        $page = Tools::getValue('page', 1);
+        $idProduct = (int) Tools::getValue('id_product');
+        $page = (int) Tools::getValue('page', 1);
         $isLastNameAnynomus = Configuration::get('PRODUCT_COMMENTS_ANONYMISATION');
         /** @var ProductCommentRepository $productCommentRepository */
         $productCommentRepository = $this->context->controller->getContainer()->get('product_comment_repository');
diff --git a/productcomments.php b/productcomments.php
index 68d9bd24..1d33e8fc 100644
--- a/productcomments.php
+++ b/productcomments.php
@@ -178,7 +178,7 @@ protected function _postProcess()
             $comment->delete();
         } elseif (Tools::isSubmit('submitEditCriterion')) {
             $criterion = new ProductCommentCriterion((int) Tools::getValue('id_product_comment_criterion'));
-            $criterion->id_product_comment_criterion_type = Tools::getValue('id_product_comment_criterion_type');
+            $criterion->id_product_comment_criterion_type = (int) Tools::getValue('id_product_comment_criterion_type');
             $criterion->active = Tools::getValue('active');
 
             $languages = Language::getLanguages();
diff --git a/src/Repository/ProductCommentRepository.php b/src/Repository/ProductCommentRepository.php
index 955b7757..af95a95f 100644
--- a/src/Repository/ProductCommentRepository.php
+++ b/src/Repository/ProductCommentRepository.php
@@ -179,7 +179,7 @@ public function getAverageGrades(array $productIds, $validatedOnly)
         $count = count($productIds);
 
         foreach ($productIds as $index => $id) {
-            $esqID = pSQL($id);
+            $esqID = (int) $id;
 
             $sql .= ' SUM(IF(id_product = ' . $esqID . ' AND deleted = 0';
             if ($validatedOnly) {
@@ -247,7 +247,7 @@ public function getCommentsNumberForProducts(array $productIds, $validatedOnly)
         $count = count($productIds);
 
         foreach ($productIds as $index => $id) {
-            $esqID = pSQL($id);
+            $esqID = (int) $id;
 
             $sql .= ' SUM(IF(id_product = ' . $esqID . ' AND deleted = 0';
             if ($validatedOnly) {