CVE-2019-9002: Missing Authorization (CWE-862)
value: An issue was discovered in Tiny Issue 1.3.1 and pixeline Bugs through 1.3.2c. install/config-setup.php allows remote attackers to execute arbitrary PHP code via the database_host parameter if the installer remains present in its original directory after installation is completed.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 9.8
Published: 2019-02-22T07:29Z
Repository: https://github.com/pixeline/bugs
Language: PHP
Files changed: install/config-setup.php, install/index.php
Commit date: 2019-02-20 09:08:03 -0500
Commit message: config-setup deleted after install ... safety concern

Diff: diff --git a/install/config-setup.php b/install/config-setup.php
index 07d99f9..63f7113 100755
--- a/install/config-setup.php
+++ b/install/config-setup.php
@@ -77,11 +77,11 @@ if(isset($_POST['create_config']) && isset($_POST['database_host'])) {
 		fwrite($FILEphp, $linePHP);
 		fclose($FILEphp);
 	}
 	//From the freshly made mysql-structure.php file, we'll create tables and default data along the install.php process
 	require "./install.php";
-	$install = new install();
+	$install = new install();
 	$database_check = $install->check_connect();
 	$install->config = require '../config.app.php';
 	$install->create_database($_POST);
 ?>
 <!DOCTYPE html>
@@ -217,11 +217,20 @@ if(!file_exists('../config.app.php')){ ?>
 				</td>
 			</tr>
 			<tr>
 				<th><?php echo $MyLng['Email_port']; ?></th>
 				<td>
-					<input type="text" name="email_port" value="" placeholder="default: 25; gmail: 587" />
+					<select name="email_port">
+					<option value="25"> 25 (default)</option>
+					<option value="587">587 (gmail)</option>
+					<option value="465">465 (SSL / TLS)</option>
+					<?php
+						for ($x=1; $x<999; $x++) {
+							echo '<option value="'.$x.'">'.$x.'</option>';
+						}
+					?>
+					</select>
 				</td>
 			</tr>
 			<tr>
 				<th><?php echo $MyLng['Email_encryption']; ?></th>
 				<td>
@@ -251,25 +260,26 @@ if(!file_exists('../config.app.php')){ ?>
 			</tr>
 			<tr style="background-color: #DDD;">
 				<th><?php echo $MyLng['Time_Timezone']; ?></th>
 				<td>
 					<select name="timezone">
-<?php
-$timezones = timezone_identifiers_list();
-
-echo 'select name="timezone" size="10">' . "\n";
-
-foreach($timezones as $timezone)
-{
-  echo '<option';
-  echo $timezone == 'Europe/Brussels' ? ' selected' : '';
-  echo '>' . $timezone . '</option>' . "\n";
-}
-
-echo '</select>' . "\n";
-?>
-						</select>
+						<?php
+						$timezones = timezone_identifiers_list();
+						
+						echo 'select name="timezone" size="10">' . "\n";
+						
+						foreach($timezones as $timezone)
+						{
+						  echo '<option';
+//						  echo $timezone == 'Europe/Brussels' ? ' selected' : '';
+						  echo $timezone == date("e") ? ' selected' : '';
+						  echo '>' . $timezone . '</option>' . "\n";
+						}
+						
+						echo '</select>' . "\n";
+						?>
+					</select>
 					</td>
 				</tr>
 				<tr>
 					<th></th>
 					<td>
diff --git a/install/index.php b/install/index.php
index 66833c4..1741455 100755
--- a/install/index.php
+++ b/install/index.php
@@ -1,11 +1,19 @@
 <?php
 include_once "../app/application/language/all.php";
 $EnLng = require_once("../app/application/language/en/install.php");
 if (!isset($_GET["Lng"]) || !file_exists("../app/application/language/".@$_GET["Lng"]."/install.php")) { $_GET["Lng"] = 'en'; }
 if (@$_GET["Lng"] != 'en' ) { $MyLng = require_once("../app/application/language/".$_GET["Lng"]."/install.php"); $MyLng = array_merge($EnLng, $MyLng); } else {$MyLng = $EnLng; }
-require './config-setup.php';
+if (!file_exists('./config-setup.php')) {
+	echo '<script>';
+	echo 'alert("Install already has been proceessed");';
+	echo 'document.location.href="../index.php";';
+	echo '</script>';
+	die();
+} else {
+	require './config-setup.php';
+}
 require '../app/laravel/hash.php';
 require '../app/laravel/str.php';
 
 
 $first_name_error = '';
@@ -28,11 +36,12 @@ if(!$database_check['error']) {
 				session_start();
 				$_SESSION["Msg"]  = '<h2 style="color: #060;">'.$MyLng['Complete_awesome'].'</h2>';
 				$_SESSION["Msg"] .= '<p style="color: #060;">'.$MyLng['Complete_presentation'].'</p>';
 				$_SESSION["usr"] = $_POST['email'];  
 				$_SESSION["psw"] = $_POST['password'];  
-				//header('location: complete.php?Lng=fr');
+				//header('location: complete.php?Lng=fr');
+				unlink ("./config-setup.php");
 				header('location: ../');
 				die();
 			}
 		} else {
 			if(trim($_POST['email']) == '' || $_POST['email'] == "you@domain.com") 		{ $email_error = $MyLng['InitError_email']; }

Vulnerable code: 	$install = new install();
					<input type="text" name="email_port" value="" placeholder="default: 25; gmail: 587" />
<?php
$timezones = timezone_identifiers_list();

echo 'select name="timezone" size="10">' . "\n";

foreach($timezones as $timezone)
{
  echo '<option';
  echo $timezone == 'Europe/Brussels' ? ' selected' : '';
  echo '>' . $timezone . '</option>' . "\n";
}

echo '</select>' . "\n";
?>
						</select>
require './config-setup.php';
				//header('location: complete.php?Lng=fr');
Fixed code: 	$install = new install();
					<select name="email_port">
					<option value="25"> 25 (default)</option>
					<option value="587">587 (gmail)</option>
					<option value="465">465 (SSL / TLS)</option>
					<?php
						for ($x=1; $x<999; $x++) {
							echo '<option value="'.$x.'">'.$x.'</option>';
						}
					?>
					</select>
						<?php
						$timezones = timezone_identifiers_list();
						
						echo 'select name="timezone" size="10">' . "\n";
						
						foreach($timezones as $timezone)
						{
						  echo '<option';
//						  echo $timezone == 'Europe/Brussels' ? ' selected' : '';
						  echo $timezone == date("e") ? ' selected' : '';
						  echo '>' . $timezone . '</option>' . "\n";
						}
						
						echo '</select>' . "\n";
						?>
					</select>
if (!file_exists('./config-setup.php')) {
	echo '<script>';
	echo 'alert("Install already has been proceessed");';
	echo 'document.location.href="../index.php";';
	echo '</script>';
	die();
} else {
	require './config-setup.php';
}
				//header('location: complete.php?Lng=fr');
				unlink ("./config-setup.php");