From 8a9d865edc4cc041b60ef69b49380dfb085371fe Mon Sep 17 00:00:00 2001 From: "imre.agent" Date: Wed, 22 Jul 2026 11:02:59 +0200 Subject: [PATCH] fix(mod_alworkshops): cast hidden_id to int to close SQL injection The workshop-application handler assigned $_POST['hidden_id'] straight into $app['user_id'], which is then concatenated unescaped into two SELECT statements (user_id=" . $app['user_id']). An attacker could inject SQL through the hidden_id POST field. user_id is a numeric key everywhere else in this same file (e.g. line 89 already uses (int)$_POST['user_id']); applying the same (int) cast closes the injection with no behaviour change. Assisted-by: claude-code@claude-opus-4-8 --- .../modules/mod_alworkshops/assets/ajax/alworkshops.class.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cadline/modules/modules/mod_alworkshops/assets/ajax/alworkshops.class.php b/cadline/modules/modules/mod_alworkshops/assets/ajax/alworkshops.class.php index 8ed0576c..762f610d 100644 --- a/cadline/modules/modules/mod_alworkshops/assets/ajax/alworkshops.class.php +++ b/cadline/modules/modules/mod_alworkshops/assets/ajax/alworkshops.class.php @@ -187,7 +187,7 @@ class Controller extends BaseController } // application rekord mentés - $app['user_id'] = $_POST['hidden_id']; + $app['user_id'] = (int)$_POST['hidden_id']; $app['name'] = trim(addslashes(ucwords($_POST['usr']))); $app['email'] = trim(addslashes($_POST['email'])); MySqlHelper::getInstance()->insert('alworkshops_application', $app); -- 2.34.1