CVE-2021-3172: Other (NVD-CWE-Other)
value: An issue in Php-Fusion v9.03.90 fixed in v9.10.00 allows authenticated attackers to cause a Distributed Denial of Service via the Polling feature.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 8.1
Published: 2023-02-17T18:15Z
Repository: https://github.com/PHPFusion/PHPFusion
Language: PHP
Files changed: includes/core_functions_include.php, infusions/member_poll_panel/poll_classes.php
Commit date: 2021-01-14 11:57:43 +0800
Commit message: #2351 - User IP fixes, and Poll Voting form token to 1 count per screen refresh.

Diff: diff --git a/includes/core_functions_include.php b/includes/core_functions_include.php
index 37383fb85..7288486b9 100644
--- a/includes/core_functions_include.php
+++ b/includes/core_functions_include.php
@@ -1971,11 +1971,11 @@ function fusion_get_username($user_id) {
  * @return string|array
  */
 function fusion_get_userdata($key = NULL) {
     global $userdata;
     if (empty($userdata)) {
-        $userdata = ["user_level" => 0, "user_rights" => "", "user_groups" => "", "user_theme" => 'Default'];
+        $userdata = ["user_level" => 0, "user_rights" => "", "user_groups" => "", "user_theme" => 'Default', "user_ip"=>USER_IP];
     }
     $userdata = $userdata + [
             "user_id"     => 0,
             "user_name"   => fusion_get_locale("user_guest"),
             "user_status" => 1,
diff --git a/infusions/member_poll_panel/poll_classes.php b/infusions/member_poll_panel/poll_classes.php
index 47729bb84..5c4ad696a 100644
--- a/infusions/member_poll_panel/poll_classes.php
+++ b/infusions/member_poll_panel/poll_classes.php
@@ -453,13 +453,14 @@ class MemberPoll {
 
                 foreach ($data['poll_option'] as $im1 => $data1) {
                     $render['poll_table'][0]['poll_option'][] = form_checkbox('check', $data1, '-1', ['reverse_label' => TRUE, 'type' => 'radio', 'value' => $im1, 'input_id' => 'check-'.$im1]);
                 }
 
-                $render['poll_table'][0]['openform'] = openform('voteform', 'post', clean_request(), ['enctype' => TRUE]).form_hidden('poll_id', '', $data['poll_id']);
+                $render['poll_table'][0]['openform'] = openform('voteform', 'post', clean_request(), ['max_tokens'=>1]).form_hidden('poll_id', '', $data['poll_id']);
                 $render['poll_table'][0]['button'] = form_button("cast_vote", self::$locale['POLL_020'], self::$locale['POLL_020'], ['class' => 'btn-primary']);
                 $render['poll_table'][0]['closeform'] = closeform();
+
             } else {
                 if (!empty($data['poll_title']) && $data['poll_started'] < time()) {
                     $render['poll_table'][0]['max_vote'] = $this->_countVote("poll_id='".$data['poll_id']."'");
                     $render['poll_table'][0]['poll_title'] = $data['poll_title'];
 

Vulnerable code:         $userdata = ["user_level" => 0, "user_rights" => "", "user_groups" => "", "user_theme" => 'Default'];
                $render['poll_table'][0]['openform'] = openform('voteform', 'post', clean_request(), ['enctype' => TRUE]).form_hidden('poll_id', '', $data['poll_id']);
Fixed code:         $userdata = ["user_level" => 0, "user_rights" => "", "user_groups" => "", "user_theme" => 'Default', "user_ip"=>USER_IP];
                $render['poll_table'][0]['openform'] = openform('voteform', 'post', clean_request(), ['max_tokens'=>1]).form_hidden('poll_id', '', $data['poll_id']);