CVE-2023-1886: Authentication Bypass by Capture-replay (CWE-294)
value: Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


CWE description: A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
CVSS v3 base score: 9.8
Published: 2023-04-05T17:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/ajaxservice.php, phpmyfaq/lang/language_de.php, phpmyfaq/src/phpMyFAQ/Captcha.php
Commit date: 2023-02-15 17:43:04 +0100
Commit message: fix: corrected check on null values

Diff: diff --git a/phpmyfaq/ajaxservice.php b/phpmyfaq/ajaxservice.php
index dca80db2f4..ccb3c3e3c2 100644
--- a/phpmyfaq/ajaxservice.php
+++ b/phpmyfaq/ajaxservice.php
@@ -114,12 +114,12 @@ if ($user instanceof CurrentUser) {
 //
 $captcha = new Captcha($faqConfig);
 $captcha->setUserIsLoggedIn($isLoggedIn);
 
 if (
-'savevoting' !== $action && 'saveuserdata' !== $action && 'changepassword' !== $action && !is_null($code) &&
-    !$captcha->checkCaptchaCode($code)
+    'savevoting' !== $action && 'saveuserdata' !== $action && 'changepassword' !== $action &&
+    !$captcha->checkCaptchaCode($code ?? '')
 ) {
     $message = ['error' => $PMF_LANG['msgCaptcha']];
 }
 
 //
diff --git a/phpmyfaq/lang/language_de.php b/phpmyfaq/lang/language_de.php
index c2a0c61e9d..c2f53e9827 100755
--- a/phpmyfaq/lang/language_de.php
+++ b/phpmyfaq/lang/language_de.php
@@ -153,11 +153,11 @@ $PMF_LANG['err_noHeaders'] = "Keine Kategorie gefunden!";
 $PMF_LANG['err_noArticles'] = "Es gibt noch keine Einträge.";
 $PMF_LANG['err_badID'] = "Fehlerhafte ID!";
 $PMF_LANG['err_noTopTen'] = "Derzeit sind keine beliebten FAQs verfügbar.";
 $PMF_LANG['err_nothingFound'] = "Es wurde kein Eintrag gefunden.";
 $PMF_LANG['err_SaveEntries'] = "Pflichtfelder sind <strong>Name</strong>, <strong>E-Mail-Adresse</strong>, <strong>Kategorie</strong>, <strong>Frage</strong> und <strong>Antwort</strong>!";
-$PMF_LANG['err_SaveComment'] = "Pflichtfelder sind <strong>Name</strong>, <strong>E-Mail-Adresse</strong> und <strong>Kommentar</strong>!";
+$PMF_LANG['err_SaveComment'] = "Pflichtfelder sind Name, E-Mail-Adresse und Kommentar!";
 $PMF_LANG['err_VoteTooMuch'] = "Leider konnte die Bewertung nicht gespeichert werden, da mit der IP bereits bewertet wurde.";
 $PMF_LANG['err_noVote'] = "Es wurde keine Bewertung abgegeben!";
 $PMF_LANG['err_noMailAdress'] = "Die angegebene E-Mail-Adresse ist nicht korrekt.";
 $PMF_LANG['err_sendMail'] = "Pflichtfelder sind u.a. <strong>Name</strong> und <strong>E-Mail-Adresse</strong>!";
 
diff --git a/phpmyfaq/src/phpMyFAQ/Captcha.php b/phpmyfaq/src/phpMyFAQ/Captcha.php
index 050e68b21a..0902e13730 100755
--- a/phpmyfaq/src/phpMyFAQ/Captcha.php
+++ b/phpmyfaq/src/phpMyFAQ/Captcha.php
@@ -489,14 +489,14 @@ class Captcha
 
     /**
      * This function checks the provided captcha code
      * if the captcha code spam protection has been activated from the general PMF configuration.
      *
-     * @param string $code Captcha Code
+     * @param string|null $code Captcha Code
      * @return bool
      */
-    public function checkCaptchaCode(string $code): bool
+    public function checkCaptchaCode(string $code = null): bool
     {
         if ($this->isUserIsLoggedIn()) {
             return true;
         }
         if ($this->config->get('spam.enableCaptchaCode')) {

Vulnerable code: 'savevoting' !== $action && 'saveuserdata' !== $action && 'changepassword' !== $action && !is_null($code) &&
    !$captcha->checkCaptchaCode($code)
$PMF_LANG['err_SaveComment'] = "Pflichtfelder sind <strong>Name</strong>, <strong>E-Mail-Adresse</strong> und <strong>Kommentar</strong>!";
     * @param string $code Captcha Code
    public function checkCaptchaCode(string $code): bool
Fixed code:     'savevoting' !== $action && 'saveuserdata' !== $action && 'changepassword' !== $action &&
    !$captcha->checkCaptchaCode($code ?? '')
$PMF_LANG['err_SaveComment'] = "Pflichtfelder sind Name, E-Mail-Adresse und Kommentar!";
     * @param string|null $code Captcha Code
    public function checkCaptchaCode(string $code = null): bool