Nhances/nhance
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sql injecter issue test : GWM

Browse Source
This commit is contained in:
Gowtham M 2026-02-12 12:39:53 +05:30
parent 1fa120779d
commit 4ebf2cb54a
4 changed files with 37 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
app/Controllers/ICICILombardController.php
View File

@ -121,28 +121,28 @@ class ICICILombardController extends AdminController
$body = [ $body = [
"PolicyNumber" => "4016/PPN/A/O/53185987/00/000", "PolicyNumber" => "4016/PPN/A/O/53185987/00/000",
"CDBGAccountNumber" => "CD-MUM-0026", "CDBGAccountNumber" => "CD-MUM-0026",
"CorrelationId" => "550e8400-e29b-41d4-a716-446655440018", "CorrelationId" => "550e8400-e29b-41d4-a716-446655440021",
"MemberDetails" => [ "MemberDetails" => [
[ [
"MemberEmpId" => "EMPID3625562", "MemberEmpId" => "EMPID3625564",
"DOJ" => "21-MAR-2019", "DOJ" => "21-MAR-2019",
"InsuredName" => "Jeeva", "InsuredName" => "Jeeva",
"DOB" => "7-JUL-1993", "DOB" => "7-JUL-1993",
"Relationship" => "SELF", "Relationship" => "SELF",
"Gender" => "MALE", "Gender" => "MALE",
"DOC" => '19-Nov-2025', "DOC" => '18-Nov-2025',
"SumInsured" => "500000", "SumInsured" => "500000",
"EmailId" => "Jeeva@GMAIL.COM", "EmailId" => "Jeeva@GMAIL.COM",
"FlagStatus" => "A" "FlagStatus" => "A"
], ],
[ [
"MemberEmpId" => "EMPID3625562", "MemberEmpId" => "EMPID3625564",
"DOJ" => "21-MAR-2019", "DOJ" => "21-MAR-2019",
"InsuredName" => "Muthu", "InsuredName" => "Muthu",
"DOB" => "8-AUG-1970", "DOB" => "8-AUG-1970",
"Relationship" => "MOTHER", "Relationship" => "MOTHER",
"Gender" => "FEMALE", "Gender" => "FEMALE",
"DOC" => '19-Nov-2025', "DOC" => '18-Nov-2025',
"EmailId" => "Muthu@GMAIL.COM", "EmailId" => "Muthu@GMAIL.COM",
"FlagStatus" => "A" "FlagStatus" => "A"
], ],
@ -180,8 +180,8 @@ class ICICILombardController extends AdminController
$body = [ $body = [
"PolicyNumber" => "4016/PPN/A/O/53185987/00/000", "PolicyNumber" => "4016/PPN/A/O/53185987/00/000",
"BatchId" => "3725147", "BatchId" => "3727144",
"CorrelationId" => "550e8400-e29b-41d4-a716-446655440018" "CorrelationId" => "550e8400-e29b-41d4-a716-446655440021"
]; ];
$response = call_third_party_api($url, 'POST', $headers, $body, true); $response = call_third_party_api($url, 'POST', $headers, $body, true);
@ -213,9 +213,9 @@ class ICICILombardController extends AdminController
]; ];
$body = [ $body = [
"PolicyNumber" => "4016/PPN/A/O/53167743/00/000", "PolicyNumber" => "4016/PPN/A/O/53185987/00/000",
"IMID" => "201580517901", "IMID" => "201580517901",
"CorrelationId" => "550e8400-e29b-41d4-a716-446655440018" "CorrelationId" => "550e8400-e29b-41d4-a716-446655440020"
]; ];
$response = call_third_party_api($url, 'POST', $headers, $body, true); $response = call_third_party_api($url, 'POST', $headers, $body, true);

16
app/Models/EmployeePolicyModel.php
View File

@ -1114,9 +1114,9 @@ class EmployeePolicyModel extends Model
public function getDeletionEmployeeDataForExportExcel($ref_data, $return_type = 0) public function getDeletionEmployeeDataForExportExcel($ref_data, $return_type = 0)
{ {
$client_id = $ref_data['client_id']; $client_id = (string) "'".$ref_data['client_id']."'";
$client_policy_id = $ref_data['client_policy_id']; $client_policy_id = (string) "'".$ref_data['client_policy_id']."'";
$client_branch_id = $ref_data['client_branch_id']; $client_branch_id = (string) "'".$ref_data['client_branch_id']."'";
$insurer_or_tpa = $ref_data['insurer_or_tpa']; $insurer_or_tpa = $ref_data['insurer_or_tpa'];
$get_insurer_id_from_client_policy = $this->db->table('client_policy') $get_insurer_id_from_client_policy = $this->db->table('client_policy')
@ -1929,6 +1929,8 @@ class EmployeePolicyModel extends Model
public function getDeletionDataForTruncated($file_id) public function getDeletionDataForTruncated($file_id)
{ {
$file_id = (int)$file_id;
// Fetch the necessary details in a single query using JOINs // Fetch the necessary details in a single query using JOINs
$result = $this->db->table('files f') $result = $this->db->table('files f')
->select('i.deletion_add_day') ->select('i.deletion_add_day')
@ -2064,6 +2066,8 @@ class EmployeePolicyModel extends Model
$action = "da"; $action = "da";
} }
$file_id = (int)$file_id;
$query = $this->db->query(" $query = $this->db->query("
SELECT SELECT
@ -2086,6 +2090,7 @@ class EmployeePolicyModel extends Model
// dd($this->db->getLastQuery(), $result); // dd($this->db->getLastQuery(), $result);
// dd($result); // dd($result);
return $result[0]; return $result[0];
} }
@ -2096,6 +2101,8 @@ class EmployeePolicyModel extends Model
log_message('error', 'updateEmployeePolicyTruncateReverse model function called'); log_message('error', 'updateEmployeePolicyTruncateReverse model function called');
log_message('error', 'FILE ID : {data}', ['data' => $file_id]); log_message('error', 'FILE ID : {data}', ['data' => $file_id]);
$file_id = (int)$file_id;
$this->db->query(" $this->db->query("
UPDATE employee_polices UPDATE employee_polices
SET SET
@ -2137,6 +2144,9 @@ class EmployeePolicyModel extends Model
//calculate the CD Transaction sum of the amount for the inception, addition, dependent addition, missed inception //calculate the CD Transaction sum of the amount for the inception, addition, dependent addition, missed inception
public function calculateCdTranctionAmount($file_id) public function calculateCdTranctionAmount($file_id)
{ {
$file_id = (int)$file_id;
$query = $this->db->query(" $query = $this->db->query("
SELECT SELECT

2
app/Models/MessageModel.php
View File

@ -73,6 +73,6 @@ class MessageModel extends Model
$query = $builder->get(); $query = $builder->get();
return $query->getResult(); return $query->getResult();
dd($this->db->getLastQuery()); // dd($this->db->getLastQuery());
} }
} }

14
app/Models/PolicyTransactionModel.php
View File

@ -2432,6 +2432,9 @@
return $result; return $result;
} }
//not in use function due to complexity of query and union, so writing raw query with bindings to avoid sql injection
public function getBDSReportListSingleUnion($start_date = 0, $end_date = 0, $client_id = 0, $insurer_id = 0, $policy_type_id = 0, $date_type = 0, $issuer = 0, $client_branch_id = 0, $insurer_branch_id = 0, $client_policy_id = 0, $user_id = 0, $where = []) public function getBDSReportListSingleUnion($start_date = 0, $end_date = 0, $client_id = 0, $insurer_id = 0, $policy_type_id = 0, $date_type = 0, $issuer = 0, $client_branch_id = 0, $insurer_branch_id = 0, $client_policy_id = 0, $user_id = 0, $where = [])
{ {
@ -3015,6 +3018,15 @@
public function getBDSReportList($start_date = 0, $end_date = 0, $client_id = 0, $insurer_id = 0, $policy_type_id = 0, $date_type = 0, $issuer = 0, $client_branch_id = 0, $insurer_branch_id = 0, $client_policy_id = 0, $user_id = 0, $where = []) public function getBDSReportList($start_date = 0, $end_date = 0, $client_id = 0, $insurer_id = 0, $policy_type_id = 0, $date_type = 0, $issuer = 0, $client_branch_id = 0, $insurer_branch_id = 0, $client_policy_id = 0, $user_id = 0, $where = [])
{ {
$client_id = (int)$client_id;
$insurer_id = (int)$insurer_id;
$policy_type_id = (int)$policy_type_id;
$client_branch_id = (int)$client_branch_id;
$insurer_branch_id = (int)$insurer_branch_id;
$client_policy_id = (int)$client_policy_id;
$user_id = (int)$user_id;
$issuer = (int)$issuer;
$whereAdded = false; $whereAdded = false;
$statement_month_condition = ''; $statement_month_condition = '';
if ($date_type == 'statement_month' && $start_date != 0 && $end_date != 0) { if ($date_type == 'statement_month' && $start_date != 0 && $end_date != 0) {
@ -3689,6 +3701,8 @@
"; ";
$query = $this->db->query($sql); $query = $this->db->query($sql);
$result = $query->getResultArray(); $result = $query->getResultArray();
// $countofalldata = count($result); // $countofalldata = count($result);
// dd($result); // dd($result);
// dd($this->db->getLastQuery()->getQuery()); // dd($this->db->getLastQuery()->getQuery());