Skip to content
This repository has been archived by the owner on Dec 13, 2022. It is now read-only.

FIX: SQLi in poller's broker configuration 21.10.x #11778

Merged
merged 1 commit into from
Sep 21, 2022
Merged

FIX: SQLi in poller's broker configuration 21.10.x #11778

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions www/class/centreonConfigCentreonBroker.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -731,13 +731,15 @@ public function insertConfig($values)
/*
* Get the ID
*/
$query = "SELECT config_id FROM cfg_centreonbroker WHERE config_name = '" . $values['name'] . "'";
$query = "SELECT config_id FROM cfg_centreonbroker WHERE config_name = :config_name";
try {
$res = $this->db->query($query);
$statement = $this->db->prepare($query);
$statement->bindValue(':config_name', $values['name'], \PDO::PARAM_STR);
$statement->execute();
} catch (\PDOException $e) {
return false;
}
$row = $res->fetch();
$row = $statement->fetch(\PDO::FETCH_ASSOC);
$id = $row['config_id'];

/*
Expand Down
91 changes: 70 additions & 21 deletions www/include/configuration/configCentreonBroker/DB-Func.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,8 +74,10 @@ function enableCentreonBrokerInDB($id)
return;
}

$query = "UPDATE cfg_centreonbroker SET config_activate = '1' WHERE config_id = " . $id;
$pearDB->query($query);
$query = "UPDATE cfg_centreonbroker SET config_activate = '1' WHERE config_id = :config_id";
$statement = $pearDB->prepare($query);
$statement->bindValue(':config_id', (int) $id, \PDO::PARAM_INT);
$statement->execute();
}

/**
Expand All @@ -91,8 +93,10 @@ function disablCentreonBrokerInDB($id)
return;
}

$query = "UPDATE cfg_centreonbroker SET config_activate = '0' WHERE config_id = " . $id;
$pearDB->query($query);
$query = "UPDATE cfg_centreonbroker SET config_activate = '0' WHERE config_id = :config_id";
$statement = $pearDB->prepare($query);
$statement->bindValue(':config_id', (int) $id, \PDO::PARAM_INT);
$statement->execute();
}

/**
Expand All @@ -104,8 +108,10 @@ function deleteCentreonBrokerInDB($ids = array())
{
global $pearDB;

$statement = $pearDB->prepare("DELETE FROM cfg_centreonbroker WHERE config_id = :config_id");
foreach ($ids as $key => $value) {
$pearDB->query("DELETE FROM cfg_centreonbroker WHERE config_id = " . $key);
$statement->bindValue(':config_id', (int) $key, \PDO::PARAM_INT);
$statement->execute();
}
}

Expand Down Expand Up @@ -194,13 +200,7 @@ function multipleCentreonBrokerInDB($ids, $nbrDup)
foreach ($ids as $id => $value) {
$cbObj = new CentreonConfigCentreonBroker($pearDB);

$query = "SELECT config_name, config_filename, config_activate, ns_nagios_server,
event_queue_max_size, cache_directory, daemon "
. "FROM cfg_centreonbroker "
. "WHERE config_id = " . $id . " ";
$dbResult = $pearDB->query($query);
$row = $dbResult->fetch();
$dbResult->closeCursor();
$row = getCfgBrokerData((int) $id);

# Prepare values
$values = array();
Expand All @@ -210,14 +210,11 @@ function multipleCentreonBrokerInDB($ids, $nbrDup)
$values['event_queue_max_size'] = $row['event_queue_max_size'];
$values['cache_directory'] = $row['cache_directory'];
$values['activate_watchdog']['activate_watchdog'] = $row['daemon'];
$query = "SELECT config_key, config_value, config_group, config_group_id "
. "FROM cfg_centreonbroker_info "
. "WHERE config_id = " . $id . " ";
$dbResult = $pearDB->query($query);
$values['output'] = array();
$values['input'] = array();
$values['logger'] = array();
while ($rowOpt = $dbResult->fetch()) {
$brokerCfgInfoData = getCfgBrokerInfoData((int) $id);
foreach ($brokerCfgInfoData as $rowOpt) {
if ($rowOpt['config_key'] == 'filters') {
continue;
} elseif ($rowOpt['config_key'] == 'category') {
Expand All @@ -228,7 +225,6 @@ function multipleCentreonBrokerInDB($ids, $nbrDup)
$rowOpt['config_value'];
}
}
$dbResult->closeCursor();

# Convert values radio button
foreach ($values as $group => $groups) {
Expand All @@ -254,16 +250,18 @@ function multipleCentreonBrokerInDB($ids, $nbrDup)

# Copy the configuration
$j = 1;
$query = "SELECT COUNT(*) as nb FROM cfg_centreonbroker WHERE config_name = :config_name";
$statement = $pearDB->prepare($query);
for ($i = 1; $i <= $nbrDup[$id]; $i++) {
$nameNOk = true;

# Find the name
while ($nameNOk) {
$newname = $row['config_name'] . '_' . $j;
$newfilename = $j . '_' . $row['config_filename'];
$query = "SELECT COUNT(*) as nb FROM cfg_centreonbroker WHERE config_name = '" . $newname . "'";
$res = $pearDB->query($query);
$rowNb = $res->fetch();
$statement->bindValue(':config_name', $newname, \PDO::PARAM_STR);
$statement->execute();
$rowNb = $statement->fetch(\PDO::FETCH_ASSOC);
if ($rowNb['nb'] == 0) {
$nameNOk = false;
}
Expand Down Expand Up @@ -293,3 +291,54 @@ function isPositiveNumeric($size): bool
}
return $isPositive;
}

/**
* Getting Centreon CFG broker data
*
* @param int $configId
* @return array
*/
function getCfgBrokerData(int $configId): array
{
global $pearDB;

$query = "SELECT config_name, config_filename, config_activate, ns_nagios_server,
event_queue_max_size, cache_directory, daemon "
. "FROM cfg_centreonbroker "
. "WHERE config_id = :config_id ";
try {
$statement = $pearDB->prepare($query);
$statement->bindValue(':config_id', $configId, \PDO::PARAM_INT);
$statement->execute();
$cfgBrokerData = $statement->fetch(\PDO::FETCH_ASSOC);
} catch (PDOException $exception) {
throw new \Exception("Cannot fetch Broker config data");
}
$statement->closeCursor();
return $cfgBrokerData;
}

/**
* Getting Centreon CFG broker Info data
*
* @param int $configId
* @return array
*/
function getCfgBrokerInfoData(int $configId): array
{
global $pearDB;

$query = "SELECT config_key, config_value, config_group, config_group_id "
. "FROM cfg_centreonbroker_info "
. "WHERE config_id = :config_id";
try {
$statement = $pearDB->prepare($query);
$statement->bindValue(':config_id', $configId, \PDO::PARAM_INT);
$statement->execute();
$cfgBrokerInfoData = $statement->fetchAll(\PDO::FETCH_ASSOC);
} catch (\PDOException $exception) {
throw new \Exception("Cannot fetch Broker info config data");
}
$statement->closeCursor();
return $cfgBrokerInfoData;
}