623979 - Lack of parameterized queries allows SQL injection on count-update.php

Status: VERIFIED FIXED

(www.mozilla.org :: General, defect)

Description

[Yvan Boily [:ygjb][:yvan]]

Issue 
The file count-update.php constructs a dynamic SQL query from validated user supplied input.  In order to prevent SQL injection attacks it is important to use parameterized statements. 

Steps to Reproduce
The current version of count-update.php is not exploitable, but the following lines contain a call to mysql_query using a dynamic SQL query.
14-	$query = "UPDATE $table SET count=count+$grow WHERE id=$id";
15:	mysql_query($query, $connection) or throwException(mysql_error());
16-	print "ok";


Recommended Remediation
To prevent this from occurring, implement parameterized queries for each sql query in the application.  For additional guidance, please refer to https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Preventing_SQL_Injection

Comment 1

[Daisuke Akatsuka]

I committed new code that uses PDO.
Please review again.

Comment 2

[Yvan Boily [:ygjb][:yvan]]

SQL injection corrected.

Comment 3

[David Chan [:dchan]]

Verified as fixed on staging. Parameterized queries are used, a non-numeric id results in an error message