I haven't tested myself whether SQL injection is actually possible on the live site, but:
- The WM-Bot Phab project indicates that the code repo for https://wm-bot.wmcloud.org/ is https://github.com/benapetr/wikimedia-bot.
- src/WMBot.Plugins/GitHub/listener/index.php#L37 indicates that the value of $payload->GetRepositoryName() is concatenated into an SQL query string (executed by mysqli_query on the next line) without being filtered/escaped/sanitised.
- src/WMBot.Plugins/GitHub/listener/github.php#L76 indicates that the repo_name property (which is what is returned by GetRepositoryName()) is taken from $this->priv_json['repository']['full_name'].
- github.php#L71 indicates that the priv_json property is the result of JSON-decoding the $json parameter that's been passed to that class's constructor.
- The value passed to the class's constructor (index.php#L26) is the raw data from the request body (index.php#L22; https://www.php.net/manual/en/wrappers.php.php#wrappers.php.input).
- index.php doesn't appear to perform any validation that the webhook request has originated from GitHub.
Therefore, from reading the code, I suspect that it would be possible to perform SQL injection through https://wm-bot.wmcloud.org/github/index.php by POSTing a request body similar to the following:
{
"repository": {
"full_name": "' OR sleep(5);--"
},
"commits": [
{
"url": "https://example.com",
"id": "1234",
"message": "commit message",
"author": {
"username": "example-user",
"name": "example",
"email": "example@example.com"
}
}
]
}