Search API Database Search - Critical - SQL Injection

Description

The Database search module provides a Search API backend that indexes and searches content using ordinary database tables.

When a search query used the "NOT BETWEEN" range operator on a field that is not a fulltext field and holds a single value, the service class assembled the query condition by placing the two bound values straight into the SQL string, while every other operator passed its value to the database as a bound parameter. Because the Views numeric filter and the range facet feature both expose these bounds as free text that reaches the query unchanged, a value supplied by a visitor was interpreted as SQL rather than as data.

This vulnerability is mitigated by the fact that a site is only affected if it exposes a range filter or a range facet on an indexed field to users who are not trusted, which is not the case in a default installation.

Solution

Install the latest version.

If you use the Search API Database Search module for Drupal 7, upgrade to Search API Database Search 7.x-1.10:

• search_api_db-7.x-1.10.tar.gz
• search_api_db-7.x-1.10.zip

Reported by

• Ra Mänd (ram4nd)

Fixed by

• Tag1 D7ES

Coordinated by

• Tag1 D7ES