CVE-2022-3754: Weak Password Requirements (CWE-521)
value: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
CWE description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
CVSS v3 base score: 9.8
Published: 2022-10-29T13:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/pwd.change.php, phpmyfaq/src/phpMyFAQ/Installer.php
Commit date: 2022-10-21 12:48:47 +0200
Commit message: fix: check for at least 8 characters for a password

Diff: diff --git a/phpmyfaq/admin/pwd.change.php b/phpmyfaq/admin/pwd.change.php
index e2385dd70..02e63ea7b 100644
--- a/phpmyfaq/admin/pwd.change.php
+++ b/phpmyfaq/admin/pwd.change.php
@@ -51,26 +51,33 @@ if ($user->perm->hasPermission($user->getUserId(), 'passwd')) {
 
         $oldPassword = Filter::filterInput(INPUT_POST, 'opass', FILTER_UNSAFE_RAW);
         $newPassword = Filter::filterInput(INPUT_POST, 'npass', FILTER_UNSAFE_RAW);
         $retypedPassword = Filter::filterInput(INPUT_POST, 'bpass', FILTER_UNSAFE_RAW);
 
-        if (($authSource->checkCredentials($user->getLogin(), $oldPassword)) && ($newPassword == $retypedPassword)) {
-            if (!$user->changePassword($newPassword)) {
+        if (strlen($newPassword) <= 7 || strlen($retypedPassword) <= 7) {
+            printf(
+                '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
+                $PMF_LANG['ad_passwd_fail']
+            );
+        } else {
+            if (($authSource->checkCredentials($user->getLogin(), $oldPassword)) && ($newPassword == $retypedPassword)) {
+                if (!$user->changePassword($newPassword)) {
+                    printf(
+                        '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
+                        $PMF_LANG['ad_passwd_fail']
+                    );
+                }
+                printf(
+                    '<p class="alert alert-success"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
+                    $PMF_LANG['ad_passwdsuc']
+                );
+            } else {
                 printf(
                     '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                     $PMF_LANG['ad_passwd_fail']
                 );
             }
-            printf(
-                '<p class="alert alert-success"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
-                $PMF_LANG['ad_passwdsuc']
-            );
-        } else {
-            printf(
-                '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
-                $PMF_LANG['ad_passwd_fail']
-            );
         }
     }
     ?>
   <div class="row">
     <div class="col-lg-12">
diff --git a/phpmyfaq/src/phpMyFAQ/Installer.php b/phpmyfaq/src/phpMyFAQ/Installer.php
index ff444515c..d40384c62 100644
--- a/phpmyfaq/src/phpMyFAQ/Installer.php
+++ b/phpmyfaq/src/phpMyFAQ/Installer.php
@@ -843,48 +843,49 @@ class Installer
             }
         } else {
             $esSetup = [];
         }
 
-        // check loginname
+        // check login name
         if (!isset($setup['loginname'])) {
             $loginName = Filter::filterInput(INPUT_POST, 'loginname', FILTER_UNSAFE_RAW);
         } else {
             $loginName = $setup['loginname'];
         }
         if (is_null($loginName)) {
-            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a loginname for your account.</p>';
+            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a login name for your account.</p>';
             System::renderFooter(true);
         }
 
         // check user entries
         if (!isset($setup['password'])) {
             $password = Filter::filterInput(INPUT_POST, 'password', FILTER_UNSAFE_RAW);
         } else {
             $password = $setup['password'];
         }
         if (is_null($password)) {
-            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a password for the your ' .
-                'account.</p>';
+            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a password for your account.</p>';
             System::renderFooter(true);
         }
 
         if (!isset($setup['password_retyped'])) {
             $passwordRetyped = Filter::filterInput(INPUT_POST, 'password_retyped', FILTER_UNSAFE_RAW);
         } else {
             $passwordRetyped = $setup['password_retyped'];
         }
+
         if (is_null($passwordRetyped)) {
             echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a retyped password.</p>';
             System::renderFooter(true);
         }
 
-        if (strlen($password) <= 5 || strlen($passwordRetyped) <= 5) {
+        if (strlen($password) <= 7 || strlen($passwordRetyped) <= 7) {
             echo '<p class="alert alert-danger"><strong>Error:</strong> Your password and retyped password are too ' .
                 'short. Please set your password and your retyped password with a minimum of 6 characters.</p>';
             System::renderFooter(true);
         }
+
         if ($password != $passwordRetyped) {
             echo '<p class="alert alert-danger"><strong>Error:</strong> Your password and retyped password are not ' .
                 'equal. Please check your password and your retyped password.</p>';
             System::renderFooter(true);
         }

Vulnerable code:         if (($authSource->checkCredentials($user->getLogin(), $oldPassword)) && ($newPassword == $retypedPassword)) {
            if (!$user->changePassword($newPassword)) {
            printf(
                '<p class="alert alert-success"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                $PMF_LANG['ad_passwdsuc']
            );
        } else {
            printf(
                '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                $PMF_LANG['ad_passwd_fail']
            );
        // check loginname
            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a loginname for your account.</p>';
            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a password for the your ' .
                'account.</p>';
        if (strlen($password) <= 5 || strlen($passwordRetyped) <= 5) {
Fixed code:         if (strlen($newPassword) <= 7 || strlen($retypedPassword) <= 7) {
            printf(
                '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                $PMF_LANG['ad_passwd_fail']
            );
        } else {
            if (($authSource->checkCredentials($user->getLogin(), $oldPassword)) && ($newPassword == $retypedPassword)) {
                if (!$user->changePassword($newPassword)) {
                    printf(
                        '<p class="alert alert-danger"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                        $PMF_LANG['ad_passwd_fail']
                    );
                }
                printf(
                    '<p class="alert alert-success"><button type="button" class="close" data-dismiss="alert">&times;</button>%s</p>',
                    $PMF_LANG['ad_passwdsuc']
                );
            } else {
        // check login name
            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a login name for your account.</p>';
            echo '<p class="alert alert-danger"><strong>Error:</strong> Please add a password for your account.</p>';

        if (strlen($password) <= 7 || strlen($passwordRetyped) <= 7) {