AheadWorks - Automatic Related Products - Security issue

SQL injection

Security issue

During a security audit we discovered a SQL injection vulnerability in the "Automatic Related Products 2" module from AheadWorks. This makes it possible to inject SQL query's trough a special prepared URL.

If you want to know if this module is installed on your Magento installation look for the file: app/etc/modules/AW_Autorelated.xml.

Solution

At this moment there is no patched version but you can easily fix it yourself until there is a official fix released by AheadWorks.

In the file app/code/local/AW/Autorelated/controllers/Adminhtml/ Awautorelated/BlocksgridController.php go to the method massStatusAction and change the following:

public function massStatusAction()
{
$blocksId = $this->getRequest()->getParam('id');
if (!is_array($blocksId)) {
Mage::getSingleton('adminhtml/session')->addError($this->__('Please select item(s)'));
} else {
try {
$db = Mage::getSingleton('core/resource')->getConnection('core_write');
$db->query(
'UPDATE `' . Mage::getSingleton('core/resource')->getTableName('awautorelated/blocks')
. '` SET `status` = ' . (int)$this->getRequest()->getParam('status')
. ' WHERE `id` IN (' . implode(',', $blocksId) . ')'
);
$this->_getSession()->addSuccess(
$this->__('Total of %d record(s) were successfully updated', count($blocksId))
);
} catch (Exception $e) {
$this->_getSession()->addError($e->getMessage());
}
}
$this->_redirect('*/*/list');
}

to:

public function massStatusAction()
{
$blocksId = $this->getRequest()->getParam('id');
if (!is_array($blocksId)) {
Mage::getSingleton('adminhtml/session')->addError($this->__('Please select item(s)'));
} else {
try {
$blocksId = array_filter( $blocksId, 'is_numeric' );
$db = Mage::getSingleton('core/resource')->getConnection('core_write');
$db->query(
'UPDATE `' . Mage::getSingleton('core/resource')->getTableName('awautorelated/blocks')
. '` SET `status` = ' . (int)$this->getRequest()->getParam('status')
. ' WHERE `id` IN (' . implode(',', $blocksId) . ')'
);
$this->_getSession()->addSuccess(
$this->__('Total of %d record(s) were successfully updated', count($blocksId))
);
} catch (Exception $e) {
$this->_getSession()->addError($e->getMessage());
}
}
$this->_redirect('*/*/list');
}

This filters out all user supplied values that are not nummeric and thus can contain SQL code.

If you need any help with applying this patch, please contact us.

Update 28-11-2019

AheadWorks released a new version that fixed this security issue. If you have version 2.5.1 or later installed you are safe from this specific security leak.