SQL injection in index_chart_data action

An attacker with administrative privileges sends a crafted POST request to the `/admin/index_chart_data` endpoint with a malicious `interval` parameter containing SQL injection payloads [ref_id=1]. The request must include a valid session cookie, the `X-Requested-With: XMLHttpRequest` header, and `Content-Type: application/x-www-form-urlencoded; charset=UTF-8` [ref_id=1]. The unsanitized input flows into the `filterFunc` function, which embeds it directly into an SQL statement, allowing the attacker to execute arbitrary SQL code [ref_id=1].

The vulnerability is in the `index_chart_data` action, which receives user input and passes it unsanitized to the core model `filterFunc` function, which embeds the data directly into an SQL statement [ref_id=1]. The `period` parameter is the specific input that should be escaped before being inserted into the query [ref_id=1]. No patch files are available in the bundle.

As of the time of publication, no patched version is available [ref_id=1]. The advisory states that the `period` parameter should be escaped before being inserted into the query to prevent SQL injection [ref_id=1]. The fix would involve sanitizing or parameterizing the user-supplied input in the `index_chart_data` action before passing it to the `filterFunc` function.

1. Log in to InstantCMS using an account with administrative privileges and copy the session cookie. 2. Insert the cookie in the format `NAME=VALUE` and send the following request: `curl -X POST http://instantcms.seclab/admin/index_chart_data -b "COOKIE;" -H "X-Requested-With: XMLHttpRequest" -H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" --data "id=content&section=news&interval=SLEEP(3):day"` [ref_id=1]. The server will sleep for 3 seconds before returning the response, confirming the SQL injection [ref_id=1].