vtiger CRM <= 5.4.0 (SOAP Services) Multiple SQL Injection Vulnerabilities

1177$id = $input_array['id'];
1178$sessionid = $input_array['sessionid'];
1179$picklist_name = $adb->sql_escape_string($input_array['picklist_name']);
1180 
1181if(!validateSession($id,$sessionid))
1182return null;
1183 
1184$picklist_array = Array();
1185 
1186$admin_role = 'H2';
1187$userid = getPortalUserid();
1188$roleres = $adb->pquery("SELECT roleid from vtiger_user2role where userid = ?", array($userid));
1189$RowCount = $adb->num_rows($roleres);
1190if($RowCount > 0){
1191    $admin_role = $adb->query_result($roleres,0,'roleid');
1192}
1193 
1194$res = $adb->pquery("select vtiger_". $picklist_name.".* from vtiger_". $picklist_name." inner join vtiger_role2picklist on vtiger_role2picklist.picklistvalueid = vtiger_". $picklist_name.".picklist_valueid and vtiger_role2picklist.roleid='$admin_role'", array());

654$id = $input_array['id'];
655$only_mine = $input_array['onlymine'];
656$where = $input_array['where']; //addslashes is already added with where condition fields in portal itself
657$match = $input_array['match'];
658$sessionid = $input_array['sessionid'];
659 
660if(!validateSession($id,$sessionid))
661    return null;
662 
663// Prepare where conditions based on search query
664$join_type = '';
665$where_conditions = '';
666if(trim($where) != '') {
667    if($match == 'all' || $match == '') {
668        $join_type = " AND ";
669    } elseif($match == 'any') {
670        $join_type = " OR ";
671    }
672    $where = explode("&&&",$where);
673    $where_conditions = implode($join_type, $where);
674}

707$query = "SELECT vtiger_troubletickets.*, vtiger_crmentity.smownerid,vtiger_crmentity.createdtime, vtiger_crmentity.modifiedtime, '' AS setype
708    FROM vtiger_troubletickets
709    INNER JOIN vtiger_crmentity ON vtiger_crmentity.crmid = vtiger_troubletickets.ticketid AND vtiger_crmentity.deleted = 0
710    WHERE vtiger_troubletickets.parent_id IN (". generateQuestionMarks($entity_ids_list) .")";
711// Add conditions if there are any search parameters
712if ($join_type != '' && $where_conditions != '') {
713    $query .= " AND (".$where_conditions.")";
714}

186function SearchContactsByEmail($username,$password,$emailaddress)
187{
188  if(authentication($username,$password))
189  {
190     require_once('modules/Contacts/Contacts.php');
191 
192     $seed_contact = new Contacts();
193     $output_list = Array();
194 
195     $response = $seed_contact->get_searchbyemailid($username,$emailaddress);

282function SearchContactsByEmail($username,$session,$emailaddress)
283{
284    if(!validateSession($username,$session))
285    return null;
286    require_once('modules/Contacts/Contacts.php');
287      
288     $seed_contact = new Contacts();
289     $output_list = Array();
290      
291     $response = $seed_contact->get_searchbyemailid($username,$emailaddress);