From 8f3a29cde5bbd8608f9b42923a7d7e2598bcac4e Mon Sep 17 00:00:00 2001
From: Tony Murray <murraytony@gmail.com>
Date: Fri, 10 Jul 2020 03:45:39 -0500
Subject: [PATCH] Fix sql injection (#11923)

in custom oid code

Thanks to loginsoft p.v.t l.t.d india for the report!
Website: https://www.loginsoft.com/
---
 includes/html/forms/customoid.inc.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/html/forms/customoid.inc.php b/includes/html/forms/customoid.inc.php
index fa45fbd216..219c7861ca 100644
--- a/includes/html/forms/customoid.inc.php
+++ b/includes/html/forms/customoid.inc.php
@@ -72,8 +72,8 @@ if (!empty(mres($_POST['user_func']))) {
 }
 
 if ($action == "test") {
-    $query = "SELECT * FROM `devices` WHERE `device_id` = $device_id LIMIT 1";
-    $device = dbFetchRow($query);
+    $query = "SELECT * FROM `devices` WHERE `device_id` = ? LIMIT 1";
+    $device = dbFetchRow($query, [$device_id]);
 
     $rawdata = snmp_get($device, $oid, '-Oqv');