Severity: MEDIUM
Location: lib/Service/OrganizationSyncService.php lines 375, 490
Description:
The database table name is constructed by interpolating IAppConfig values directly into a QueryBuilder::from() call:
$contactTableName = 'openregister_table_' . $register . '_' . $contactSchema;
$qb->from($contactTableName);
$register and $contactSchema are read from admin-configurable IAppConfig keys with no type or format validation. Although only administrators can set these values, a compromised admin account or a misconfiguration could inject arbitrary SQL fragments into the table name. This is a defense-in-depth gap.
Suggested fix:
Cast $register and $contactSchema to integer with (int), assert each is > 0, and reject/log if not. Table names should only ever be constructed from validated integer IDs.
Source: deep team-reviewer pass 2026-05-27
Severity: MEDIUM
Location:
lib/Service/OrganizationSyncService.phplines 375, 490Description:
The database table name is constructed by interpolating
IAppConfigvalues directly into aQueryBuilder::from()call:$registerand$contactSchemaare read from admin-configurableIAppConfigkeys with no type or format validation. Although only administrators can set these values, a compromised admin account or a misconfiguration could inject arbitrary SQL fragments into the table name. This is a defense-in-depth gap.Suggested fix:
Cast
$registerand$contactSchemato integer with(int), assert each is> 0, and reject/log if not. Table names should only ever be constructed from validated integer IDs.Source: deep team-reviewer pass 2026-05-27