Skip to content

Commit c7cb04b

Browse files
bbdocbbdoc
authored
Merge pull request #160 from ComplementaryPogo/develop
Fix critical SQL injection vulnerabilities
2 parents 6390a8c + a0b8b92 commit c7cb04b

31 files changed

+544
-299
lines changed

‎actions/channel_sync.php‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,21 @@
55

66
if (isset($_POST['sync'])) {
77

8-
foreach ($_POST as $key => $value) {
8+
foreach ($_POST as $key => $value) {
99
if (substr($key, 0, 7) == "target_") {
1010
$target = ltrim($key, 'target_');
1111
$target_fields = explode("|", $target);
1212
$target_db=$target_fields[0];
1313
$target_id=$target_fields[1];
1414
$target_id=str_replace("_com", ".com", $target_id);
1515

16+
// Database names cannot be parameterized in prepared statements (they are identifiers, not values)
17+
// so we use a whitelist to validate the database name before using string interpolation
18+
$allowed_dbs = explode(",", $dbname);
19+
if (!in_array($target_db, $allowed_dbs)) {
20+
die("Invalid database");
21+
}
22+
1623
// Delete All Previous Trackings
1724
$stmt = $conn->prepare("DELETE FROM ".$target_db.".monsters WHERE id = ?");
1825
$rs = $stmt->bind_param("s", $target_id);

‎actions/set_language.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,10 @@
1111

1212
// Update Language in DB
1313

14-
$sql = "UPDATE humans set language = '".$_GET['lng']."' WHERE id = '" . $_SESSION['id'] . "'";
15-
$result = $conn->query($sql) or die(mysqli_error($conn));
14+
$stmt = $conn->prepare("UPDATE humans SET language = ? WHERE id = ?");
15+
$stmt->bind_param("ss", $_GET['lng'], $_SESSION['id']);
16+
$stmt->execute() or die(mysqli_error($conn));
17+
$stmt->close();
1618

1719
header("Location: $redirect_url");
1820

‎actions/set_location.php‎

Lines changed: 20 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,26 @@
1010
$lat = "0.0000000000";
1111
$lon = "0.0000000000";
1212

13-
$sql = "UPDATE monsters set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
14-
$result = $conn->query($sql);
15-
$sql = "UPDATE raid set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
16-
$result = $conn->query($sql);
17-
$sql = "UPDATE egg set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
18-
$result = $conn->query($sql);
19-
$sql = "UPDATE quest set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
20-
$result = $conn->query($sql);
21-
$sql = "UPDATE invasion set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
22-
$result = $conn->query($sql);
13+
$stmt = $conn->prepare("UPDATE monsters set distance = 0 WHERE id = ? AND profile_no = ?");
14+
$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
15+
$stmt->execute();
16+
$stmt->close();
17+
$stmt = $conn->prepare("UPDATE raid set distance = 0 WHERE id = ? AND profile_no = ?");
18+
$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
19+
$stmt->execute();
20+
$stmt->close();
21+
$stmt = $conn->prepare("UPDATE egg set distance = 0 WHERE id = ? AND profile_no = ?");
22+
$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
23+
$stmt->execute();
24+
$stmt->close();
25+
$stmt = $conn->prepare("UPDATE quest set distance = 0 WHERE id = ? AND profile_no = ?");
26+
$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
27+
$stmt->execute();
28+
$stmt->close();
29+
$stmt = $conn->prepare("UPDATE invasion set distance = 0 WHERE id = ? AND profile_no = ?");
30+
$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
31+
$stmt->execute();
32+
$stmt->close();
2333

2434
} else if ( isset($_GET['lat']) && isset($_GET['lon']) ) {
2535

‎actions/switch_profile.php‎

Lines changed: 42 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -11,23 +11,23 @@
1111
$_SESSION['profile'] = $_POST['profile'];
1212
}
1313

14-
if ( isset($_POST['activate']) ) {
15-
16-
$sql = "SELECT area, latitude, longitude from profiles WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_POST['profile']."'";
17-
$result = $conn->query($sql);
18-
while ($row = $result->fetch_assoc()) {
19-
$area = $row['area'];
20-
$latitude = $row['latitude'];
21-
$longitude = $row['longitude'];
14+
if ( isset($_POST['activate']) ) {
15+
16+
$stmt = $conn->prepare("SELECT area, latitude, longitude from profiles WHERE id = ? AND profile_no = ?");
17+
$stmt->bind_param("si", $_SESSION['id'], $_POST['profile']);
18+
$stmt->execute();
19+
$result = $stmt->get_result();
20+
while ($row = $result->fetch_assoc()) {
21+
$area = $row['area'];
22+
$latitude = $row['latitude'];
23+
$longitude = $row['longitude'];
2224
}
25+
$stmt->close();
2326

24-
$sql = "UPDATE humans
25-
SET area = '".$area."',
26-
latitude = '".$latitude."',
27-
longitude = '".$longitude."',
28-
current_profile_no = '".$_POST['profile']."'
29-
WHERE id = '" . $_SESSION['id'] . "'";
30-
$result = $conn->query($sql);
27+
$stmt = $conn->prepare("UPDATE humans SET area = ?, latitude = ?, longitude = ?, current_profile_no = ? WHERE id = ?");
28+
$stmt->bind_param("ssdis", $area, $latitude, $longitude, $_POST['profile'], $_SESSION['id']);
29+
$stmt->execute();
30+
$stmt->close();
3131
header("Location: $redirect_url?type=display&page=profiles&return=success_switch_profile_activate");
3232

3333

@@ -41,27 +41,32 @@
4141

4242
// Get Next Profile Number
4343
#$sql = "SELECT IFNULL(max(profile_no),0)+1 next_profile from profiles WHERE id = '" . $_SESSION['id'] . "'";
44-
$sql = "SELECT MIN(t1.profile_no + 1) AS nextID
45-
FROM (select profile_no from profiles WHERE id = '".$_SESSION['id']."' UNION select 0 profile_no) t1
46-
LEFT JOIN (select profile_no from profiles WHERE id = '".$_SESSION['id']."' UNION select 0 profile_no) t2
44+
$stmt = $conn->prepare("SELECT MIN(t1.profile_no + 1) AS nextID
45+
FROM (select profile_no from profiles WHERE id = ? UNION select 0 profile_no) t1
46+
LEFT JOIN (select profile_no from profiles WHERE id = ? UNION select 0 profile_no) t2
4747
ON t1.profile_no + 1 = t2.profile_no
48-
WHERE t2.profile_no IS NULL";
49-
50-
$result = $conn->query($sql);
48+
WHERE t2.profile_no IS NULL");
49+
$stmt->bind_param("ss", $_SESSION['id'], $_SESSION['id']);
50+
$stmt->execute();
51+
$result = $stmt->get_result();
5152
while ($row = $result->fetch_assoc()) {
5253
$next_profile = $row['nextID'];
5354
}
55+
$stmt->close();
5456

5557
if ( $next_profile == 1 ) {
5658
// Get Info on currently active Profile
57-
$sql = "SELECT area, latitude, longitude from humans WHERE id = '" . $_SESSION['id'] . "'";
58-
$result = $conn->query($sql);
59+
$stmt = $conn->prepare("SELECT area, latitude, longitude from humans WHERE id = ?");
60+
$stmt->bind_param("s", $_SESSION['id']);
61+
$stmt->execute();
62+
$result = $stmt->get_result();
5963
while ($row = $result->fetch_assoc()) {
6064
$area = $row['area'];
6165
$latitude = $row['latitude'];
6266
$longitude = $row['longitude'];
6367
$_SESSION['profile_name'] = $_POST['profile_name'];
6468
}
69+
$stmt->close();
6570
} else {
6671
$area = "[]";
6772
$latitude = "0.0000000000";
@@ -153,26 +158,32 @@
153158

154159
// Change Active Profile if Deleting Active one
155160

156-
$sql = "select current_profile_no FROM humans WHERE id = '" . $_SESSION['id'] . "'";
157-
$result = $conn->query($sql);
161+
$stmt = $conn->prepare("SELECT current_profile_no FROM humans WHERE id = ?");
162+
$stmt->bind_param("s", $_SESSION['id']);
163+
$stmt->execute();
164+
$result = $stmt->get_result();
158165
while ($row = $result->fetch_assoc()) {
159166
$current_profile = $row['current_profile_no'];
160167
}
168+
$stmt->close();
161169

162170
if ( $current_profile == $_SESSION['profile']) {
163-
$sql = "UPDATE humans set current_profile_no =
164-
(select IFNULL(min(profile_no),1) from profiles where id = '".$_SESSION['id']."')
165-
WHERE id = '" . $_SESSION['id'] . "'";
166-
$result = $conn->query($sql);
171+
$stmt = $conn->prepare("UPDATE humans set current_profile_no = (select IFNULL(min(profile_no),1) from profiles where id = ?) WHERE id = ?");
172+
$stmt->bind_param("ss", $_SESSION['id'], $_SESSION['id']);
173+
$stmt->execute();
174+
$stmt->close();
167175
}
168176

169177
// Check for smaller Profiles and redirect
170178

171-
$sql = "select IFNULL(min(profile_no),1) min from profiles WHERE id = '" . $_SESSION['id'] . "'";
172-
$result = $conn->query($sql);
179+
$stmt = $conn->prepare("SELECT IFNULL(min(profile_no),1) min from profiles WHERE id = ?");
180+
$stmt->bind_param("s", $_SESSION['id']);
181+
$stmt->execute();
182+
$result = $stmt->get_result();
173183
while ($row = $result->fetch_assoc()) {
174184
$_SESSION['profile'] = $row['min'];
175185
}
186+
$stmt->close();
176187

177188
header("Location: $redirect_url?type=display&page=profiles&return=success_delete_profile");
178189

‎admin_connect.php‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,10 @@
4646
}
4747

4848
$conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $_SESSION['dbname']);
49-
$sql = "select id, name, type, notes FROM humans WHERE id = '".$search_id."'";
50-
$result = $conn->query($sql);
49+
$stmt = $conn->prepare("SELECT id, name, type, notes FROM humans WHERE id = ?");
50+
$stmt->bind_param("s", $search_id);
51+
$stmt->execute();
52+
$result = $stmt->get_result();
5153

5254
if ($result->num_rows == 0) {
5355
header("Location: $redirect_url?return=user_not_found");
@@ -60,6 +62,7 @@
6062
$_SESSION['type']=$row['type'];
6163
$_SESSION['notes']=$row['notes'];
6264
}
65+
$stmt->close();
6366

6467
// Get Config Items from API and Store in Session Variables
6568

@@ -108,11 +111,14 @@
108111

109112
// Switch to active Profile
110113

111-
$sql = "SELECT current_profile_no FROM humans WHERE id = '" . $_SESSION['id'] . "'";
112-
$result = $conn->query($sql);
114+
$stmt = $conn->prepare("SELECT current_profile_no FROM humans WHERE id = ?");
115+
$stmt->bind_param("s", $_SESSION['id']);
116+
$stmt->execute();
117+
$result = $stmt->get_result();
113118
while ($row = $result->fetch_assoc()) {
114119
$_SESSION['profile'] = $row['current_profile_no'];
115120
}
121+
$stmt->close();
116122

117123
header("Location: $redirect_url");
118124

‎admin_sync.php‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -94,8 +94,10 @@
9494
foreach ($dbnames as &$db) {
9595

9696
$conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $db);
97-
$sql = "select id, name, type FROM humans WHERE type like 'discord:channel' AND id <> '".$_SESSION['id']."' ORDER by name";
98-
$result = $conn->query($sql);
97+
$stmt = $conn->prepare("SELECT id, name, type FROM humans WHERE type like 'discord:channel' AND id <> ? ORDER by name");
98+
$stmt->bind_param("s", $_SESSION['id']);
99+
$stmt->execute();
100+
$result = $stmt->get_result();
99101
?>
100102

101103
<?php if ($result->num_rows <> 0) { ?>
@@ -145,8 +147,10 @@
145147
foreach ($dbnames as &$db) {
146148

147149
$conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $db);
148-
$sql = "select id, name, type FROM humans WHERE type in ('telegram:channel','telegram:group') AND id <> '".$_SESSION['id']."' ORDER by name";
149-
$result = $conn->query($sql);
150+
$stmt = $conn->prepare("SELECT id, name, type FROM humans WHERE type in ('telegram:channel','telegram:group') AND id <> ? ORDER by name");
151+
$stmt->bind_param("s", $_SESSION['id']);
152+
$stmt->execute();
153+
$result = $stmt->get_result();
150154
?>
151155

152156
<?php if ($result->num_rows <> 0) { ?>
@@ -196,8 +200,10 @@
196200
foreach ($dbnames as &$db) {
197201

198202
$conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $db);
199-
$sql = "select id, name, type FROM humans WHERE type like 'webhook' AND id <> '".$_SESSION['id']."' ORDER by name";
200-
$result = $conn->query($sql);
203+
$stmt = $conn->prepare("SELECT id, name, type FROM humans WHERE type like 'webhook' AND id <> ? ORDER by name");
204+
$stmt->bind_param("s", $_SESSION['id']);
205+
$stmt->execute();
206+
$result = $stmt->get_result();
201207
?>
202208

203209
<?php if ($result->num_rows <> 0) { ?>

0 commit comments

Comments
 (0)