Vulnerability using API authorization with SQL Injection

[nilsteampassnet]

Fixing vulnerability regarding API authorize process

A SQL injection has been detected on the API. This injection occurs on the endpoint used to
authenticate users on the API ( /api/index.php/authorize ). It turns out that at code level, two
vulnerable queries are used to authenticate users. These SQL queries are performed in the
getUserAuth function of the /api/Model/AuthModel.php 昀椀le.
As it can be seen, a concatenation is performed in the PHP code with one of the parameters ( login )
controlled by the user. However, it remains di昀케cult to exploit, as the anti XSS 昀椀lters applied to user
input do not allow the request to be manipulated in order to add code later.
However, a second request may allow controlled injection.

The fix consists in removing the old condition of auth with a generic key, which is not allowed any more.
THis part of code has been removed and replaced by an error code.
In front, the API generic keys page has already a warning showing they should not be used any more.

[corentin-soriano]

I approve on this scope if you want to merge it however there are other SQL queries nested with PHP which are potentially vulnerable.

[nilsteampassnet]

I approve on this scope if you want to merge it however there are other SQL queries nested with PHP which are potentially vulnerable.

Any example?

[corentin-soriano]

I approve on this scope if you want to merge it however there are other SQL queries nested with PHP which are potentially vulnerable.

Any example?

Line 81

[corentin-soriano]

Great work, thank you!