PKP-WAL <= 3.5.0-1 (Institution Collector) SQL Injection Vulnerability

121    public function getQueryBuilder(): Builder
122    {
123        $qb = DB::table($this->dao->table . ' as i')->select('i.*');
124
125        if (!is_null($this->contextIds)) {
126            $qb->whereIn('i.context_id', $this->contextIds);
127        }
128
129        if (!$this->includeSoftDeletes) {
130            $qb->whereNull('i.deleted_at');
131        }
132
133        if ($this->searchPhrase !== null) {
134            $words = explode(' ', $this->searchPhrase);
135            if (count($words)) {
136                foreach ($words as $word) {
137                    $word = addcslashes($word, '%_');
138                    $qb->where(function ($qb) use ($word) {
139                        $qb->whereIn('i.institution_id', function ($qb) use ($word) {
140                            $qb->select('iss.institution_id')
141                                ->from($this->dao->settingsTable . ' as iss')
142                                ->where('iss.setting_name', '=', 'name')
143                                ->where(DB::raw('lower(iss.setting_value)'), 'LIKE', DB::raw("lower('%{$word}%')"));
144                        })
145                            ->orWhereIn('i.institution_id', function ($qb) use ($word) {
146                                $qb->select('ips.institution_id')
147                                    ->from('institution_ip as ips')
148                                    ->where(DB::raw('lower(ips.ip_string)'), 'LIKE', DB::raw("lower('%{$word}%')"));
149                            });
150                    });
151                }