CVE-2018-7269: Yii SQL injection vulnerability in yiisoft/yii2-dev

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Yii is a high-performance PHP framework used for developing web applications. The yiisoft/yii2-dev package is a development version of Yii 2.x. It provides various tools and features for developers to build robust and secure web applications. However, this package is vulnerable to a SQL injection attack due to a flaw in the findByCondition function in the framework/db/ActiveRecord.php file.

Vulnerability Detail

The vulnerability allows remote attackers to conduct SQL injection attacks by exploiting the findOne() or findAll() calls in the Yii framework. This can lead to unauthorized access, data leakage, and potential manipulation of the database. The issue arises when array input is not properly sanitized, which can be overlooked by developers who are unaware of the need to sanitize such input.

Workaround

A workaround for this vulnerability is to manually sanitize the array input before using the findOne() or findAll() functions. Here is an example of how to sanitize the input using the Yii framework's built-in methods:

$condition = Yii::$app->db->createCommand()->bindParam(':param', $param)->getRawSql();
$model = Model::findOne($condition);

By using the bindParam() method, the input is properly sanitized and the vulnerability is mitigated.

Conclusion

The Yii SQL injection vulnerability in the yiisoft/yii2-dev package can lead to unauthorized access, data leakage, and potential manipulation of the database. It is crucial for developers to upgrade to the fixed versions of the package (2.0.12.1, 2.0.13.2, or 2.0.15) or manually sanitize the array input to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for yiisoft/yii2-dev →

FAQ