wambosec/csi-sqli-rl huggingface dataset:
Security advisory GHSA-2598-2f59-rmhq: SQL Injection in sequelize
Package: sequelize (npm), vulnerable version: 3.35.0, fixed in: 3.35.1
CWE: CWE-89
Files changed by the fix:
lib/dialects/abstract/query-generator.js

Fix diff:
diff --git a/lib/dialects/abstract/query-generator.js b/lib/dialects/abstract/query-generator.js
index 0298381093eb..392e962021ab 100644
--- a/lib/dialects/abstract/query-generator.js
+++ b/lib/dialects/abstract/query-generator.js
@@ -2198,7 +2198,8 @@ var QueryGenerator = {
             path[path.length - 1] = $tmp[0];
           }
 
-          $baseKey = self.quoteIdentifier(key)+'#>>\'{'+path.join(', ')+'}\'';
+          var pathKey = self.escape('{' + path.join(', ') + '}');
+          $baseKey = self.quoteIdentifier(key)+'#>>'+pathKey;
 
           if (options.prefix) {
             if (options.prefix instanceof Utils.literal) {
Security advisory GHSA-25fx-3c2q-cq46: pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query
Package: pimcore/customer-management-framework-bundle (composer), vulnerable version: v3.3.9, fixed in: 3.3.10
CWE: CWE-89
Files changed by the fix:
src/Controller/Admin/SegmentAssignmentController.php

Fix diff:
diff --git a/src/Controller/Admin/SegmentAssignmentController.php b/src/Controller/Admin/SegmentAssignmentController.php
index eae14a2d..68f92f00 100644
--- a/src/Controller/Admin/SegmentAssignmentController.php
+++ b/src/Controller/Admin/SegmentAssignmentController.php
@@ -50,12 +50,17 @@ public static function getSubscribedServices()
      */
     public function inheritableSegments(Request $request, SegmentManagerInterface $segmentManager)
     {
-        $id = $request->get('id') ?? '';
-        $type = $request->get('type') ?? '';
+        $id = $request->get('id');
+        $type = $request->get('type');
+        if (!$type || !$id) {
+            return $this->adminJson(['data' => []]);
+        }
 
         $db = \Pimcore\Db::get();
-        $parentIdStatement = sprintf('SELECT `%s` FROM `%s` WHERE `%s` = :value', $type === 'object' ? 'o_parentId' : 'parentId', $type.'s', $type === 'object' ? 'o_id' : 'id');
+        $parentIdStatement = sprintf('SELECT :parentIdField FROM %s WHERE :idField = :value', $db->quoteIdentifier($type . 's'));
         $parentId = $db->fetchOne($parentIdStatement, [
+            'parentIdField' => $type === 'object' ? 'o_parentId' : 'parentId',
+            'idField' => $type === 'object' ? 'o_id' : 'id',
             'value' => $id
         ]);
Security advisory GHSA-2fr7-cc4f-wh98: OpenSTAManager: SQL Injection via Aggiornamenti Module
Package: devcode-it/openstamanager (composer), vulnerable version: v2.10.1, fixed in: 2.10.2
CWE: CWE-89
Files changed by the fix:
modules/aggiornamenti/actions.php

Fix diff:
diff --git a/modules/aggiornamenti/actions.php b/modules/aggiornamenti/actions.php
index d51873ab80..1ba88147d8 100755
--- a/modules/aggiornamenti/actions.php
+++ b/modules/aggiornamenti/actions.php
@@ -64,22 +64,66 @@
             break;
         }
 
-        $debug_queries = implode('<br>', $queries);
+        // WHITELIST: Permetti solo pattern SQL sicuri
+        $allowed_patterns = [
+            '/^ALTER\s+TABLE\s+`?[\w]+`?\s+(ADD|MODIFY|CHANGE|DROP)\s+(COLUMN\s+)?`?[\w]+`?/i',
+            '/^CREATE\s+(UNIQUE\s+)?INDEX\s+`?[\w]+`?\s+ON\s+`?[\w]+`?\s*\(/i',
+            '/^DROP\s+INDEX\s+`?[\w]+`?\s+ON\s+`?[\w]+`?$/i',
+            '/^UPDATE\s+`?zz_views`?\s+SET\s+/i',
+            '/^INSERT\s+INTO\s+`?zz_\w+`?\s*\(/i',
+            '/^DELETE\s+FROM\s+`?zz_\w+`?\s+WHERE\s+/i',
+        ];
+
+        $safe_queries = [];
+        $rejected = [];
 
-        $dbo->query('SET FOREIGN_KEY_CHECKS=0');
+        foreach ($queries as $query) {
+            $is_safe = false;
+            foreach ($allowed_patterns as $pattern) {
+                if (preg_match($pattern, trim($query))) {
+                    $is_safe = true;
+                    break;
+                }
+            }
+
+            if ($is_safe) {
+                $safe_queries[] = $query;
+            } else {
+                $rejected[] = $query;
+            }
+        }
+
+        if (!empty($rejected)) {
+            echo json_encode([
+                'success' => false,
+                'message' => tr('Query non permesse rilevate. Operazione bloccata per motivi di sicurezza.'),
+                'rejected_count' => count($rejected),
+            ]);
+            break;
+        }
+
+        if (empty($safe_queries)) {
+            echo json_encode([
+                'success' => false,
+                'message' => tr('Nessuna query valida da eseguire dopo la validazione.'),
+            ]);
+            break;
+        }
+
+        $debug_queries = implode('<br>', $safe_queries);
 
         $errors = [];
         $executed = 0;
 
-        foreach ($queries as $query) {
+        foreach ($safe_queries as $query) {
             try {
                 $dbo->query($query);
                 ++$executed;
             } catch (Exception $e) {
-                $errors[] = $query.' - '.$e->getMessage();
+                // Sanifica il messaggio di errore per evitare leak di informazioni
+                $errors[] = tr('Errore durante l\'esecuzione di una query.');
             }
         }
-        $dbo->query('SET FOREIGN_KEY_CHECKS=1');
 
         if (empty($errors)) {
             $success_message = tr('Tutte le query sono state eseguite con successo (_NUM_ query).', [
Security advisory GHSA-2grw-mc9r-822r: phpMyFAQ SQL injections at insertentry & saveentry
Package: phpmyfaq/phpmyfaq (composer), vulnerable version: 3.2.5, fixed in: 3.2.6
CWE: CWE-89
Files changed by the fix:
phpmyfaq/src/phpMyFAQ/Faq.php

Fix diff:
diff --git a/phpmyfaq/src/phpMyFAQ/Faq.php b/phpmyfaq/src/phpMyFAQ/Faq.php
index 343933dedf..ade9895540 100755
--- a/phpmyfaq/src/phpMyFAQ/Faq.php
+++ b/phpmyfaq/src/phpMyFAQ/Faq.php
@@ -925,13 +925,13 @@ public function create(FaqEntity $faq): int
             $this->config->getDb()->escape($faq->getQuestion()),
             $this->config->getDb()->escape($faq->getAnswer()),
             $this->config->getDb()->escape($faq->getAuthor()),
-            $faq->getEmail(),
+            $this->config->getDb()->escape($faq->getEmail()),
             $faq->isComment() ? 'y' : 'n',
             $faq->getUpdatedDate()->format('YmdHis'),
             '00000000000000',
             '99991231235959',
             date('Y-m-d H:i:s'),
-            $faq->getNotes()
+            $this->config->getDb()->escape($faq->getNotes())
         );
 
         $this->config->getDb()->query($query);
@@ -994,12 +994,12 @@ public function update(FaqEntity $faq): bool
             $this->config->getDb()->escape($faq->getQuestion()),
             $this->config->getDb()->escape($faq->getAnswer()),
             $this->config->getDb()->escape($faq->getAuthor()),
-            $faq->getEmail(),
+            $this->config->getDb()->escape($faq->getEmail()),
             $faq->isComment() ? 'y' : 'n',
             $faq->getUpdatedDate()->format('YmdHis'),
             $faq->getValidFrom()->format('YmdHis'),
             $faq->getValidTo()->format('YmdHis'),
-            $faq->getNotes(),
+            $this->config->getDb()->escape($faq->getNotes()),
             $faq->getId(),
             $faq->getLanguage()
         );
Security advisory GHSA-2jx3-5j9v-prpp: BlockWishList SQL Injection vulnerability
Package: prestashop/blockwishlist (composer), vulnerable version: v2.1.0, fixed in: 2.1.1
CWE: CWE-89
Files changed by the fix:
src/Search/WishListProductSearchProvider.php

Fix diff:
diff --git a/src/Search/WishListProductSearchProvider.php b/src/Search/WishListProductSearchProvider.php
index efab3b30..5e2d1e7b 100644
--- a/src/Search/WishListProductSearchProvider.php
+++ b/src/Search/WishListProductSearchProvider.php
@@ -35,6 +35,7 @@
 use Product;
 use Shop;
 use Symfony\Component\Translation\TranslatorInterface;
+use Validate;
 use WishList;
 
 /**
@@ -167,7 +168,10 @@ private function getProductsOrCount(
 
         if ('products' === $type) {
             $sortOrder = $query->getSortOrder()->toLegacyOrderBy(true);
-            $querySearch->orderBy($sortOrder . ' ' . $query->getSortOrder()->toLegacyOrderWay());
+            $sortWay = $query->getSortOrder()->toLegacyOrderWay();
+            if (Validate::isOrderBy($sortOrder) && Validate::isOrderWay($sortWay)) {
+                $querySearch->orderBy($sortOrder . ' ' . $sortWay);
+            }
             $querySearch->limit((int) $query->getResultsPerPage(), ((int) $query->getPage() - 1) * (int) $query->getResultsPerPage());
             $products = $this->db->executeS($querySearch);
Security advisory GHSA-2v5m-cq9w-fc33: Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality
Package: admidio/admidio (composer), vulnerable version: v4.3.16, fixed in: 4.3.17
CWE: CWE-89
Files changed by the fix:
adm_program/modules/groups-roles/members_assignment_data.php

Fix diff:
diff --git a/adm_program/modules/groups-roles/members_assignment_data.php b/adm_program/modules/groups-roles/members_assignment_data.php
index 64fb51f208..c7312691e3 100644
--- a/adm_program/modules/groups-roles/members_assignment_data.php
+++ b/adm_program/modules/groups-roles/members_assignment_data.php
@@ -50,7 +50,7 @@
 
 // Initialize and check the parameters
 $getRoleUuid       = admFuncVariableIsValid($_GET, 'role_uuid', 'string', array('requireValue' => true, 'directOutput' => true));
-$getFilterRoleUuid = admFuncVariableIsValid($_GET, 'filter_rol_uuid', 'string');
+$getFilterRoleUuid = StringUtils::strValidCharacters(admFuncVariableIsValid($_GET, 'filter_rol_uuid', 'string'), 'noSpecialChar');
 $getMembersShowAll = admFuncVariableIsValid($_GET, 'mem_show_all', 'bool', array('defaultValue' => false));
 $getDraw   = admFuncVariableIsValid($_GET, 'draw', 'int', array('requireValue' => true));
 $getStart  = admFuncVariableIsValid($_GET, 'start', 'int', array('requireValue' => true));
Security advisory GHSA-2v7p-f4qm-r5pc: SQL Injection found in Pimcore
Package: pimcore/pimcore (composer), vulnerable version: v10.3.5, fixed in: 10.3.6
CWE: CWE-89
Files changed by the fix:
bundles/AdminBundle/Helper/GridHelperService.php

Fix diff:
diff --git a/bundles/AdminBundle/Helper/GridHelperService.php b/bundles/AdminBundle/Helper/GridHelperService.php
index 13b6541eced..1ccfe6407fb 100644
--- a/bundles/AdminBundle/Helper/GridHelperService.php
+++ b/bundles/AdminBundle/Helper/GridHelperService.php
@@ -332,12 +332,13 @@ public function getFilterCondition($filterJson, ClassDefinition $class, $tablePr
                         } elseif ($filterField == 'id') {
                             $conditionPartsFilters[] = 'oo_id ' . $operator . ' ' . $db->quote($filter['value']);
                         } else {
+                            $filterField = $db->quoteIdentifier('o_' . $filterField);
                             if ($filter['type'] == 'date' && $operator == '=') {
                                 //if the equal operator is chosen with the date type, condition has to be changed
                                 $maxTime = $filter['value'] + (86400 - 1); //specifies the top point of the range used in the condition
-                                $conditionPartsFilters[] = '`o_' . $filterField . '` BETWEEN ' . $db->quote($filter['value']) . ' AND ' . $db->quote($maxTime);
+                                $conditionPartsFilters[] = $filterField . ' BETWEEN ' . $db->quote($filter['value']) . ' AND ' . $db->quote($maxTime);
                             } else {
-                                $conditionPartsFilters[] = '`o_' . $filterField . '` ' . $operator . ' ' . $db->quote($filter['value']);
+                                $conditionPartsFilters[] = $filterField . ' ' . $operator . ' ' . $db->quote($filter['value']);
                             }
                         }
                     }
@@ -780,6 +781,8 @@ public function prepareAssetListingForGrid($allParams, $adminUser)
 
                 if ($filterField == 'fullpath') {
                     $filterField = 'CONCAT(path,filename)';
+                }else {
+                    $filterField = $db->quoteIdentifier($filterField);
                 }
 
                 if (isset($filterDef[1]) && $filterDef[1] == 'system') {
Security advisory GHSA-2v82-5746-vwqc: XSS in doc_link
Package: vrana/adminer (composer), vulnerable version: v4.8.0, fixed in: 4.8.1
CWE: CWE-79
Files changed by the fix:
adminer/include/editing.inc.php

Fix diff:
diff --git a/adminer/include/editing.inc.php b/adminer/include/editing.inc.php
index 88d66d447..5556b0147 100644
--- a/adminer/include/editing.inc.php
+++ b/adminer/include/editing.inc.php
@@ -542,7 +542,7 @@ function doc_link($paths, $text = "<sup>?</sup>") {
 		$urls['sql'] = "https://mariadb.com/kb/en/library/";
 		$paths['sql'] = (isset($paths['mariadb']) ? $paths['mariadb'] : str_replace(".html", "/", $paths['sql']));
 	}
-	return ($paths[$jush] ? "<a href='$urls[$jush]$paths[$jush]'" . target_blank() . ">$text</a>" : "");
+	return ($paths[$jush] ? "<a href='" . h($urls[$jush] . $paths[$jush]) . "'" . target_blank() . ">$text</a>" : "");
 }
 
 /** Wrap gzencode() for usage in ob_start()
diff --git a/changes.txt b/changes.txt
index 9622f194b..a9e45a5ca 100644
--- a/changes.txt
+++ b/changes.txt
@@ -1,4 +1,5 @@
 Adminer 4.8.1-dev:
+Internet Explorer or PDO in Adminer 4.7.8-4.8.0: Fix XSS in doc_link (bug #797)
 Fix more PHP 8 warnings (bug #781)
 Avoid PHP warnings with PDO drivers (bug #786, regression from 4.7.8)
 MySQL: Allow moving views to other DB and renaming DB with views (bug #783)
Security advisory GHSA-3234-gxc3-pq6f: Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration
Package: pimcore/pimcore (composer), vulnerable version: v12.3.5, fixed in: 12.3.6
CWE: CWE-89
Files changed by the fix:
bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php

Fix diff:
diff --git a/bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php b/bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php
index f3c97efb248..1ee18902ec8 100644
--- a/bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php
+++ b/bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php
@@ -63,8 +63,11 @@ public function getColumns(?stdClass $configuration): array
         if ($configuration) {
             $sql = $this->buildQueryString($configuration);
         }
+        $sqlStripped = $this->stripSqlCommentsForValidation($sql);
 
-        if (!preg_match('/(ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE) /i', $sql, $matches)) {
+        if (
+            !preg_match('/(ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE)\s/i', $sqlStripped, $matches)
+        ) {
             $sql .= ' LIMIT 0,1';
             $db = Db::get();
             $res = $db->fetchAssociative($sql);
@@ -188,7 +191,10 @@ protected function getBaseQuery(array $filters, array $fields, bool $ignoreSelec
             }
         }
 
-        if (!preg_match('/(ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE) /i', $sql, $matches)) {
+        $sqlStripped = $this->stripSqlCommentsForValidation($sql);
+        if (
+            !preg_match('/(ALTER|CREATE|DROP|RENAME|TRUNCATE|UPDATE|DELETE)\s/i', $sqlStripped, $matches)
+        ) {
             $condition = implode(' AND ', $condition);
 
             $total = 'SELECT COUNT(*) FROM (' . $sql . ') AS somerandxyz WHERE ' . $condition;
@@ -235,4 +241,12 @@ public function getAvailableOptions(array $filters, string $field, array $drillD
             ),
         ];
     }
+
+    private function stripSqlCommentsForValidation(string $sql): string
+    {
+        $sqlStripped = preg_replace('/\/\*!\d*\s*(.*?)\*\//s', ' $1 ', $sql);
+        $sqlStripped = preg_replace('/\/\*(?!\!).*?\*\//s', ' ', $sqlStripped ?? '');
+        $sqlStripped = preg_replace('/\s+/', ' ', $sqlStripped ?? '');
+        return $sqlStripped;
+    }
 }
Security advisory GHSA-35pq-7pv2-2rfw: ps_contactinfo has a potential XSS due to usage of the nofilter tag in template
Package: prestashop/ps_contactinfo (composer), vulnerable version: v3.3.2, fixed in: 3.3.3
CWE: CWE-79
Files changed by the fix:
ps_contactinfo.php

Fix diff:
diff --git a/ps_contactinfo.php b/ps_contactinfo.php
index eda96b5..89c09d5 100644
--- a/ps_contactinfo.php
+++ b/ps_contactinfo.php
@@ -88,6 +88,7 @@ public function renderWidget($hookName = null, array $configuration = [])
     public function getWidgetVariables($hookName = null, array $configuration = [])
     {
         $address = $this->context->shop->getAddress();
+        $formattedAddress = AddressFormat::generateAddress($address, [], '<br />');
 
         $is_state_multilang = !empty(State::$definition['multilang']);
         $state_name = (new State($address->id_state))->name;
@@ -95,7 +96,7 @@ public function getWidgetVariables($hookName = null, array $configuration = [])
         $contact_infos = [
             'company' => Configuration::get('PS_SHOP_NAME'),
             'address' => [
-                'formatted' => AddressFormat::generateAddress($address, [], '<br />'),
+                'formatted' => Validate::isCleanHtml($formattedAddress) ? $formattedAddress : '',
                 'address1' => $address->address1,
                 'address2' => $address->address2,
                 'postcode' => $address->postcode,
Security advisory GHSA-3fj4-q72x-x2g9: ADOdb Library SQL Injection
Package: adodb/adodb-php (composer), vulnerable version: v5.20.6, fixed in: 5.20.7
CWE: CWE-89
Files changed by the fix:
drivers/adodb-pdo.inc.php

Fix diff:
diff --git a/drivers/adodb-pdo.inc.php b/drivers/adodb-pdo.inc.php
index e3f49a4f2..63a3e6e04 100644
--- a/drivers/adodb-pdo.inc.php
+++ b/drivers/adodb-pdo.inc.php
@@ -518,6 +518,30 @@ function _insertid()
 	{
 		return ($this->_connectionID) ? $this->_connectionID->lastInsertId() : 0;
 	}
+
+	/**
+	 * Quotes a string to be sent to the database.
+	 * If we have an active connection, delegates quoting to the underlying
+	 * PDO object. Otherwise, replace "'" by the value of $replaceQuote (same
+	 * behavior as mysqli driver)
+	 * @param string  $s            The string to quote
+	 * @param boolean $magic_quotes If false, use PDO::quote().
+	 * @return string Quoted string
+	 */
+	function qstr($s, $magic_quotes = false)
+	{
+		if (!$magic_quotes) {
+			if ($this->_connectionID) {
+				return $this->_connectionID->quote($s);
+			}
+			return "'" . str_replace("'", $this->replaceQuote, $s) . "'";
+		}
+
+		// undo magic quotes for "
+		$s = str_replace('\\"', '"', $s);
+		return "'$s'";
+	}
+
 }
 
 class ADODB_pdo_base extends ADODB_pdo {
Security advisory GHSA-3gw8-3mg3-jmpc: OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter
Package: devcode-it/openstamanager (composer), vulnerable version: v2.10.1, fixed in: 2.10.2
CWE: CWE-89
Files changed by the fix:
modules/contratti/ajax/select.php
modules/ordini/ajax/select.php
modules/preventivi/ajax/select.php

Fix diff:
diff --git a/modules/contratti/ajax/select.php b/modules/contratti/ajax/select.php
index 011657eb68..7786c40ef9 100755
--- a/modules/contratti/ajax/select.php
+++ b/modules/contratti/ajax/select.php
@@ -57,7 +57,7 @@
             $stato = !empty($superselect['stato']) && in_array($superselect['stato'], $allowed_stati)
                 ? $superselect['stato']
                 : 'is_pianificabile';
-            $where[] = '`idstato` IN (SELECT `id` FROM `co_staticontratti` WHERE '.$stato.' = 1)';
+            $where[] = '`idstato` IN (SELECT `id` FROM `co_staticontratti` WHERE `'.str_replace('`', '', $stato).'` = 1)';
         }
 
         if (!empty($search)) {
diff --git a/modules/ordini/ajax/select.php b/modules/ordini/ajax/select.php
index 123c34e004..d93165c7e5 100644
--- a/modules/ordini/ajax/select.php
+++ b/modules/ordini/ajax/select.php
@@ -53,6 +53,7 @@
                     ? $superselect['stato']
                     : 'is_fatturabile';
                 $where[] = '`or_statiordine`.'.$stato.' = 1';
+                $where[] = '`or_statiordine`.`'.str_replace('`', '', $stato).'` = 1';
             }
         }
 
diff --git a/modules/preventivi/ajax/select.php b/modules/preventivi/ajax/select.php
index 6dead2e8d6..6cce6bdbd1 100755
--- a/modules/preventivi/ajax/select.php
+++ b/modules/preventivi/ajax/select.php
@@ -60,7 +60,7 @@
                 $stato = !empty($superselect['stato']) && in_array($superselect['stato'], $allowed_stati)
                     ? $superselect['stato']
                     : 'is_pianificabile';
-                $where[] = '('.$stato.' = 1)';
+                $where[] = '(`'.str_replace('`', '', $stato).'` = 1)';
             }
 
             if (!empty($search)) {
Security advisory GHSA-42c3-wvww-gcqj: Pimcore Remote Code Execution vulnerability in Search function
Package: pimcore/pimcore (composer), vulnerable version: v10.5.18, fixed in: 10.5.19
CWE: CWE-89
Files changed by the fix:
bundles/AdminBundle/Controller/Searchadmin/SearchController.php

Fix diff:
diff --git a/bundles/AdminBundle/Controller/Searchadmin/SearchController.php b/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
index 5d7c7da863c..a5405cf9dc5 100644
--- a/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
+++ b/bundles/AdminBundle/Controller/Searchadmin/SearchController.php
@@ -77,9 +77,9 @@ public function findAction(Request $request, EventDispatcherInterface $eventDisp
 
         $query = $this->filterQueryParam($allParams['query'] ?? '');
 
-        $types = explode(',', $allParams['type'] ?? '');
-        $subtypes = explode(',', $allParams['subtype'] ?? '');
-        $classnames = explode(',', $allParams['class'] ?? '');
+        $types = explode(',', preg_replace("/[^a-z,]/i", '', $allParams['type'] ?? ''));
+        $subtypes = explode(',', preg_replace("/[^a-z,]/i", '', $allParams['subtype'] ?? ''));
+        $classnames = explode(',', preg_replace("/[^a-z0-9_,]/i", '', $allParams['class'] ?? ''));
 
         $offset = (int)$allParams['start'];
         $limit = (int)$allParams['limit'];
Security advisory GHSA-4rwr-8c3m-55f6: TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter
Package: torrentpier/torrentpier (composer), vulnerable version: v2.8.8, fixed in: 2.8.9
CWE: CWE-89
Files changed by the fix:
modcp.php

Fix diff:
diff --git a/modcp.php b/modcp.php
index 63b0591300..56da1a1b0e 100644
--- a/modcp.php
+++ b/modcp.php
@@ -73,9 +73,9 @@ function validate_mode_condition($request_index, $mod_action = '')
 $user->session_start(['req_login' => true]);
 
 // Obtain initial vars
-$forum_id = $_REQUEST[POST_FORUM_URL] ?? 0;
-$topic_id = $_REQUEST[POST_TOPIC_URL] ?? 0;
-$post_id = $_REQUEST[POST_POST_URL] ?? 0;
+$forum_id = isset($_REQUEST[POST_FORUM_URL]) ? (int)$_REQUEST[POST_FORUM_URL] : 0;
+$topic_id = isset($_REQUEST[POST_TOPIC_URL]) ? (int)$_REQUEST[POST_TOPIC_URL] : 0;
+$post_id = isset($_REQUEST[POST_POST_URL]) ? (int)$_REQUEST[POST_POST_URL] : 0;
 
 $start = isset($_REQUEST['start']) ? abs((int)$_REQUEST['start']) : 0;
 $confirmed = isset($_POST['confirm']);
Security advisory GHSA-57wj-22w9-wm9r: Dolibarr SQL injection vulnerability
Package: dolibarr/dolibarr (composer), vulnerable version: 7.0.1, fixed in: 7.0.2
CWE: CWE-89
Files changed by the fix:
htdocs/adherents/list.php

Fix diff:
diff --git a/htdocs/adherents/list.php b/htdocs/adherents/list.php
index cae878829b71a..68062b895a092 100644
--- a/htdocs/adherents/list.php
+++ b/htdocs/adherents/list.php
@@ -43,7 +43,7 @@
 $result=restrictedArea($user,'adherent');
 
 $filter=GETPOST("filter",'alpha');
-$statut=GETPOST("statut",'alpha');
+$statut=GETPOST("statut",'intcomma');
 $search=GETPOST("search",'alpha');
 $search_ref=GETPOST("search_ref",'alpha');
 $search_lastname=GETPOST("search_lastname",'alpha');