MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

security: fix unescaped parameter leading to sqli

pull/7694/head
Luciano Righetti 2021-08-19 14:53:10 +02:00
parent f91fd30440
commit 20d9020b76
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/Model/Log.php
View File

@ -174,7 +174,7 @@ class Log extends AppModel
// cakephp ORM would escape "DATE" datatype in CAST expression
$condnotinaction = "'" . implode("', '", $conditions['AND']['NOT']['action']) . "'";
if (!empty($conditions['org'])) {
$condOrg = ' AND org = "' . $conditions['org'] . '"';
$condOrg = sprintf('AND org = %s', $this->getDataSource()->value($conditions['org']));
} else {
$condOrg = '';
}