Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
The Root Cause
The code path spans three files:
1. pnadmin.php (line 376) – injection point
[enlighter lang="php"]
// Before (vulnerable):
$dels = pnVarCleanFromInput('dels');
$delete = "DELETE FROM $pntable[postcalendar_categories] WHERE pc_catid IN
($dels)";
// After (safe):
$dels_raw = pnVarCleanFromInput('dels');
$ids = array_filter(array_map('intval', explode(',', $dels_raw)));
if (!empty($ids)) {
$placeholders = implode(',', array_fill(0, count($ids), '?'));
sqlStatement(
"DELETE FROM " . escape_table_name('postcalendar_categories') . "
WHERE pc_catid IN ($placeholders)",
$ids
);
}
[/enlighter]
[enlighter lang=”php”]
// Before (vulnerable):
$dels = pnVarCleanFromInput(‘dels’);
$delete = “DELETE FROM $pntable[postcalendar_categories] WHERE pc_catid IN
($dels)”;
// After (safe):
$dels_raw = pnVarCleanFromInput(‘dels’);
$ids = array_filter(array_map(‘intval’, explode(‘,’, $dels_raw)));
if (!empty($ids)) {
$placeholders = implode(‘,’, array_fill(0, count($ids), ‘?’));
sqlStatement(
“DELETE FROM ” . escape_table_name(‘postcalendar_categories’) . ”
// Before (vulnerable):
$dels = pnVarCleanFromInput(‘dels’);
$delete = “DELETE FROM $pntable[postcalendar_categories] WHERE pc_catid IN
($dels)”;
// After (safe):
$dels_raw = pnVarCleanFromInput(‘dels’);
$ids = array_filter(array_map(‘intval’, explode(‘,’, $dels_raw)));
if (!empty($ids)) {
$placeholders = implode(‘,’, array_fill(0, count($ids), ‘?’));
sqlStatement(
“DELETE FROM ” . escape_table_name(‘postcalendar_categories’) . ”
WHERE pc_catid IN ($placeholders)”,
$ids
);
}
[/enlighter]
$dels = pnVarCleanFromInput('dels');
$delete = "DELETE FROM $pntable[postcalendar_categories] WHERE pc_catid IN ($dels)";
pnModAPIFunc(__POSTCALENDAR__, 'admin', 'deleteCategories', ['delete' => $delete]);
