Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-0310: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-01-15T22:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/record.comments.php
Commit date: 2022-12-18 17:20:02 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/record.comments.php b/phpmyfaq/admin/record.comments.php
index 35560f6274..e71d347891 100644
--- a/phpmyfaq/admin/record.comments.php
+++ b/phpmyfaq/admin/record.comments.php
@@ -18,10 +18,11 @@
 use phpMyFAQ\Category;
 use phpMyFAQ\Comments;
 use phpMyFAQ\Date;
 use phpMyFAQ\Entity\CommentType;
 use phpMyFAQ\Faq;
+use phpMyFAQ\Strings;
 
 if (!defined('IS_VALID_PHPMYFAQ')) {
     http_response_code(400);
     exit();
 }
@@ -71,23 +72,23 @@ if ($user->perm->hasPermission($user->getUserId(), 'delcomment')) {
                   </label>
                 </td>
                 <td>
                 <span style="font-weight: bold;">
                     <a href="mailto:<?= $faqComment->getEmail() ?>">
-                        <?= $faqComment->getUsername() ?>
+                        <?= Strings::htmlentities($faqComment->getUsername()) ?>
                     </a> |
                     <?= $date->format(date('Y-m-d H:i', $faqComment->getDate())) ?> |
                     <a href="<?php printf(
                         '../?action=faq&cat=%d&id=%d&artlang=%s',
                         $faqComment->getCategoryId(),
                         $faqComment->getRecordId(),
                         $faqLangCode
                              ) ?>">
                         <?= $faq->getRecordTitle($faqComment->getRecordId()) ?>
                     </a>
-                </span><br/>
-                    <?= $faqComment->getComment() ?>
+                </span><br>
+                    <?= Strings::htmlentities($faqComment->getComment()) ?>
                 </td>
               </tr>
                 <?php
                 $lastCommentId = $faqComment->getId();
             }

Vulnerable code:                         <?= $faqComment->getUsername() ?>
                </span><br/>
                    <?= $faqComment->getComment() ?>
Fixed code: use phpMyFAQ\Strings;
                        <?= Strings::htmlentities($faqComment->getUsername()) ?>
                </span><br>
                    <?= Strings::htmlentities($faqComment->getComment()) ?>
CVE-2023-0311: Improper Authentication (CWE-287)
value: Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2023-01-15T22:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/src/phpMyFAQ/Captcha.php
Commit date: 2022-12-15 21:42:29 +0100
Commit message: fix: check captcha length correctly and fix type error

Diff: diff --git a/phpmyfaq/src/phpMyFAQ/Captcha.php b/phpmyfaq/src/phpMyFAQ/Captcha.php
index 1a6b606e5d..050e68b21a 100755
--- a/phpmyfaq/src/phpMyFAQ/Captcha.php
+++ b/phpmyfaq/src/phpMyFAQ/Captcha.php
@@ -432,11 +432,11 @@ class Captcha
     private function drawText()
     {
         $codeLength = Strings::strlen($this->code);
         $numFonts = count($this->fonts);
         $w1 = 15;
-        $w2 = $this->width / ($codeLength + 1);
+        $w2 = floor($this->width / ($codeLength + 1));
 
         for ($p = 0; $p < $codeLength; ++$p) {
             $letter = $this->code[$p];
             $size = random_int(18, $this->height - 5);
             $rotation = random_int(-23, 23);
@@ -513,11 +513,11 @@ class Captcha
      * @return bool
      */
     public function validateCaptchaCode(string $captchaCode): bool
     {
         // Sanity check
-        if (0 === Strings::strlen($captchaCode)) {
+        if (Strings::strlen($captchaCode) !== $this->captchaLength) {
             return false;
         }
 
         $captchaCode = Strings::strtoupper($captchaCode);
         // Help the user: treat "0" (ASCII 48) like "O" (ASCII 79)

Vulnerable code:         $w2 = $this->width / ($codeLength + 1);
        if (0 === Strings::strlen($captchaCode)) {
Fixed code:         $w2 = floor($this->width / ($codeLength + 1));
        if (Strings::strlen($captchaCode) !== $this->captchaLength) {
CVE-2023-0312: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-15T22:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/add.php
Commit date: 2022-12-17 12:36:46 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/add.php b/phpmyfaq/add.php
index 78f11e8a28..a16853604f 100644
--- a/phpmyfaq/add.php
+++ b/phpmyfaq/add.php
@@ -5,16 +5,16 @@
  *
  * This Source Code Form is subject to the terms of the Mozilla Public License,
  * v. 2.0. If a copy of the MPL was not distributed with this file, You can
  * obtain one at http://mozilla.org/MPL/2.0/.
  *
- * @package phpMyFAQ
- * @author Thorsten Rinne <thorsten@phpmyfaq.de>
+ * @package   phpMyFAQ
+ * @author    Thorsten Rinne <thorsten@phpmyfaq.de>
  * @copyright 2002-2022 phpMyFAQ Team
- * @license http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
- * @link https://www.phpmyfaq.de
- * @since 2002-09-16
+ * @license   http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
+ * @link      https://www.phpmyfaq.de
+ * @since     2002-09-16
  */
 
 use phpMyFAQ\Captcha;
 use phpMyFAQ\Filter;
 use phpMyFAQ\Helper\CaptchaHelper;
@@ -61,11 +61,11 @@ $selectedQuestion = Filter::filterInput(INPUT_GET, 'question', FILTER_VALIDATE_I
 $selectedCategory = Filter::filterInput(INPUT_GET, 'cat', FILTER_VALIDATE_INT);
 
 $question = $readonly = '';
 if (!is_null($selectedQuestion)) {
     $oQuestion = $questionObject->getQuestion($selectedQuestion);
-    $question = $oQuestion['question'];
+    $question = Strings::htmlentities($oQuestion['question']);
     if (Strings::strlen($question)) {
         $readonly = ' readonly';
     }
 }
 

Vulnerable code:  * @package phpMyFAQ
 * @author Thorsten Rinne <thorsten@phpmyfaq.de>
 * @license http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
 * @link https://www.phpmyfaq.de
 * @since 2002-09-16
    $question = $oQuestion['question'];
Fixed code:  * @package   phpMyFAQ
 * @author    Thorsten Rinne <thorsten@phpmyfaq.de>
 * @license   http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
 * @link      https://www.phpmyfaq.de
 * @since     2002-09-16
    $question = Strings::htmlentities($oQuestion['question']);
CVE-2023-0314: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-15T22:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/index.php
Commit date: 2022-12-15 21:21:29 +0100
Commit message: fix: added missing check on redirect value

Diff: diff --git a/phpmyfaq/admin/index.php b/phpmyfaq/admin/index.php
index 0d1b089403..cb5e787aa5 100755
--- a/phpmyfaq/admin/index.php
+++ b/phpmyfaq/admin/index.php
@@ -134,11 +134,11 @@ if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token']
 }
 
 //
 // Get possible redirect action
 //
-$redirectAction = Filter::filterInput(INPUT_POST, 'redirect-action', FILTER_UNSAFE_RAW);
+$redirectAction = Filter::filterInput(INPUT_POST, 'redirect-action', FILTER_SANITIZE_SPECIAL_CHARS);
 if (is_null($action) && '' !== $redirectAction && 'logout' !== $redirectAction) {
     $action = $redirectAction;
 }
 
 // authenticate current user

Vulnerable code: $redirectAction = Filter::filterInput(INPUT_POST, 'redirect-action', FILTER_UNSAFE_RAW);
Fixed code: $redirectAction = Filter::filterInput(INPUT_POST, 'redirect-action', FILTER_SANITIZE_SPECIAL_CHARS);
CVE-2023-0788: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2023-02-12T14:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/ajaxservice.php
Commit date: 2023-01-25 08:34:31 +0100
Commit message: fix: strip tags for questions

Diff: diff --git a/phpmyfaq/ajaxservice.php b/phpmyfaq/ajaxservice.php
index 0e29ac8401..5d1b54a63c 100644
--- a/phpmyfaq/ajaxservice.php
+++ b/phpmyfaq/ajaxservice.php
@@ -480,10 +480,11 @@ switch ($action) {
         $categories = $cat->getAllCategories();
         $author = Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW);
         $email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
         $ucategory = Filter::filterInput(INPUT_POST, 'category', FILTER_VALIDATE_INT);
         $question = Filter::filterInput(INPUT_POST, 'question', FILTER_UNSAFE_RAW);
+        $question = strip_tags($question);
         $save = Filter::filterInput(INPUT_POST, 'save', FILTER_VALIDATE_INT, 0);
 
         // If e-mail address is set to optional
         if (!$faqConfig->get('main.optionalMailAddress') && is_null($email)) {
             $email = $faqConfig->getAdminEmail();

Fixed code:         $question = strip_tags($question);
CVE-2023-0789: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2023-02-12T14:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/ajaxservice.php
Commit date: 2023-01-25 08:27:10 +0100
Commit message: fix: strip tags for questions and answers

Diff: diff --git a/phpmyfaq/ajaxservice.php b/phpmyfaq/ajaxservice.php
index 00ba955a4a..0e29ac8401 100644
--- a/phpmyfaq/ajaxservice.php
+++ b/phpmyfaq/ajaxservice.php
@@ -320,15 +320,17 @@ switch ($action) {
         $author = Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW);
         $email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
         $faqId = Filter::filterInput(INPUT_POST, 'faqid', FILTER_VALIDATE_INT);
         $faqLanguage = Filter::filterInput(INPUT_POST, 'lang', FILTER_UNSAFE_RAW);
         $question = Filter::filterInput(INPUT_POST, 'question', FILTER_UNSAFE_RAW);
+        $question = strip_tags($question);
         if ($faqConfig->get('main.enableWysiwygEditorFrontend')) {
             $answer = Filter::filterInput(INPUT_POST, 'answer', FILTER_SANITIZE_SPECIAL_CHARS);
             $answer = html_entity_decode($answer);
         } else {
             $answer = Filter::filterInput(INPUT_POST, 'answer', FILTER_UNSAFE_RAW);
+            $answer = strip_tags($answer);
             $answer = nl2br($answer);
         }
         $translatedAnswer = Filter::filterInput(INPUT_POST, 'translated_answer', FILTER_UNSAFE_RAW);
         $contentLink = Filter::filterInput(INPUT_POST, 'contentlink', FILTER_UNSAFE_RAW);
         $contentLink = Filter::filterVar($contentLink, FILTER_VALIDATE_URL);

Fixed code:         $question = strip_tags($question);
            $answer = strip_tags($answer);
CVE-2023-0791: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-02-12T14:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/instances.php
Commit date: 2023-01-25 07:51:55 +0100
Commit message: fix: added missing escaping of newly added values

Diff: diff --git a/phpmyfaq/admin/instances.php b/phpmyfaq/admin/instances.php
index a4fd8b3fae..a2374dfa57 100644
--- a/phpmyfaq/admin/instances.php
+++ b/phpmyfaq/admin/instances.php
@@ -241,10 +241,14 @@ if ($user->perm->hasPermission($user->getUserId(), 'editinstances')) {
         const comment = $('#comment').val();
         const email = $('#email').val();
         const admin = $('#admin').val();
         const password = $('#password').val();
 
+        const escape = (unsafe) => {
+          return unsafe.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#039;');
+        }
+
         $.ajax({
           url: 'index.php',
           type: 'GET',
           data: {
             action: 'ajax', ajax: 'config', ajaxaction: 'add_instance', csrf: csrf, url: url,
@@ -254,12 +258,12 @@ if ($user->perm->hasPermission($user->getUserId(), 'editinstances')) {
             $('.modal').modal('hide');
             $('.table tbody').append(
               '<tr id="row-instance-' + data.added + '">' +
               '<td>' + data.added + '</td>' +
               '<td><a href="' + data.url + '">' + data.url + '</a></td>' +
-              '<td>' + instance + '</td>' +
-              '<td>' + comment + '</td>' +
+              '<td>' + escape(instance) + '</td>' +
+              '<td>' + escape(comment) + '</td>' +
               '<td>' +
               '<a href="?action=editinstance&instance_id=' + data.added +
               '" class="btn btn-info"><i aria-hidden="true" class="fa fa-pencil"></i></a>' +
               '</td>' +
               '<td>' +

Vulnerable code:               '<td>' + instance + '</td>' +
              '<td>' + comment + '</td>' +
Fixed code:         const escape = (unsafe) => {
          return unsafe.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#039;');
        }

              '<td>' + escape(instance) + '</td>' +
              '<td>' + escape(comment) + '</td>' +
CVE-2023-0794: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-02-12T14:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/header.php
Commit date: 2023-01-23 07:21:45 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/header.php b/phpmyfaq/admin/header.php
index b1035b1246..666e4b005e 100644
--- a/phpmyfaq/admin/header.php
+++ b/phpmyfaq/admin/header.php
@@ -440,11 +440,11 @@ switch ($action) {
 
               <li class="nav-item dropdown no-arrow">
                 <a class="nav-link dropdown-toggle" href="#" id="userDropdown" role="button" data-toggle="dropdown"
                    aria-haspopup="true" aria-expanded="false">
                   <span class="mr-2 d-none d-lg-inline text-gray-600 small">
-                      <?= $user->getUserData('display_name'); ?>
+                      <?= Strings::htmlentities($user->getUserData('display_name')) ?>
                   </span>
                     <?php
                     if ($faqConfig->get('main.enableGravatarSupport')) {
                         $avatar = new Gravatar();
                         echo $avatar->getImage(

Vulnerable code:                       <?= $user->getUserData('display_name'); ?>
Fixed code:                       <?= Strings::htmlentities($user->getUserData('display_name')) ?>
CVE-2023-1753: Weak Password Requirements (CWE-521)
value: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


CWE description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
CVSS v3 base score: 9.8
Published: 2023-03-31T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/ajax.user.php
Commit date: 2023-03-10 12:28:35 +0100
Commit message: fix: removed possible bypass to allow weak passwords

Diff: diff --git a/phpmyfaq/admin/ajax.user.php b/phpmyfaq/admin/ajax.user.php
index 7d15ca8e29..2021bc618c 100644
--- a/phpmyfaq/admin/ajax.user.php
+++ b/phpmyfaq/admin/ajax.user.php
@@ -141,10 +141,12 @@ if (
             }
             if (!$automaticPassword) {
                 if (strlen($userPassword) <= 7 || strlen($userPasswordConfirm) <= 7) {
                     $errorMessage[] = $PMF_LANG['ad_passwd_fail'];
                 }
+            } else {
+                $userPassword = ''; // set password to empty, so a new one is created
             }
 
             if (count($errorMessage) === 0) {
                 if (!$newUser->createUser($userName, $userPassword)) {
                     $errorMessage[] = $newUser->error();

Fixed code:             } else {
                $userPassword = ''; // set password to empty, so a new one is created
CVE-2023-1755: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-31T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/configuration.php
Commit date: 2023-02-13 13:27:32 +0100
Commit message: fix: don't update the version number

Diff: diff --git a/phpmyfaq/admin/configuration.php b/phpmyfaq/admin/configuration.php
index 7a7de663ff..7a12124788 100644
--- a/phpmyfaq/admin/configuration.php
+++ b/phpmyfaq/admin/configuration.php
@@ -50,11 +50,14 @@ if ($user->perm->hasPermission($user->getUserId(), 'editconfig')) {
             'main.metaKeywords'
         ];
 
         // Special checks
         if (isset($editData['edit']['main.enableMarkdownEditor'])) {
-            $editData['edit']['main.enableWysiwygEditor'] = false; // Disable WYSIWG editor if Markdown is enabled
+            $editData['edit']['main.enableWysiwygEditor'] = false; // Disable WYSIWYG editor if Markdown is enabled
+        }
+        if (isset($editData['edit']['main.currentVersion'])) {
+            unset($editData['edit']['main.currentVersion']); // don't update the version number
         }
 
         foreach ($editData['edit'] as $key => $value) {
             // Remove forbidden characters
             $newConfigValues[$key] = str_replace($forbiddenValues, '', $value);

Vulnerable code:             $editData['edit']['main.enableWysiwygEditor'] = false; // Disable WYSIWG editor if Markdown is enabled
Fixed code:             $editData['edit']['main.enableWysiwygEditor'] = false; // Disable WYSIWYG editor if Markdown is enabled
        }
        if (isset($editData['edit']['main.currentVersion'])) {
            unset($editData['edit']['main.currentVersion']); // don't update the version number
CVE-2023-1756: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-04-05T16:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/src/phpMyFAQ/Export/Html5.php
Commit date: 2023-02-18 11:52:18 +0100
Commit message: fix: added missing CSP for HTML5 exports

Diff: diff --git a/phpmyfaq/src/phpMyFAQ/Export/Html5.php b/phpmyfaq/src/phpMyFAQ/Export/Html5.php
index 947122a6e5..3de635a7a3 100644
--- a/phpmyfaq/src/phpMyFAQ/Export/Html5.php
+++ b/phpmyfaq/src/phpMyFAQ/Export/Html5.php
@@ -91,10 +91,14 @@ class Html5 extends Export
         $this->xml->startElement('head');
         $this->xml->writeElement('title', $this->config->getTitle());
         $this->xml->startElement('meta');
         $this->xml->writeAttribute('charset', 'utf-8');
         $this->xml->endElement();
+        $this->xml->startElement('meta');
+        $this->xml->writeAttribute('http-equiv', 'Content-Security-Policy');
+        $this->xml->writeAttribute('content', 'default-src \'self\'; img-src https://*; child-src \'none\';');
+        $this->xml->endElement();
         $this->xml->endElement(); // </head>
 
         $this->xml->startElement('body');
         $this->xml->writeAttribute('dir', $PMF_LANG['dir']);
 

Fixed code:         $this->xml->startElement('meta');
        $this->xml->writeAttribute('http-equiv', 'Content-Security-Policy');
        $this->xml->writeAttribute('content', 'default-src \'self\'; img-src https://*; child-src \'none\';');
        $this->xml->endElement();
CVE-2023-1758: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)
value: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CWE description: The product does not adequately filter user-controlled input for special elements with control implications.
CVSS v3 base score: 5.4
Published: 2023-04-05T16:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/record.comments.php
Commit date: 2023-02-14 20:36:00 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/record.comments.php b/phpmyfaq/admin/record.comments.php
index e71d347891..e7a530f98b 100644
--- a/phpmyfaq/admin/record.comments.php
+++ b/phpmyfaq/admin/record.comments.php
@@ -125,14 +125,14 @@ if ($user->perm->hasPermission($user->getUserId(), 'delcomment')) {
                   </label>
                 </td>
                 <td>
                 <span style="font-weight: bold;">
                     <a href="mailto:<?= $newsComment->getEmail() ?>">
-                        <?= $newsComment->getUsername() ?>
+                        <?= Strings::htmlentities($newsComment->getUsername()) ?>
                     </a> |
-                    <?= $date->format(date('Y-m-d H:i', $faqComment->getDate())) ?> |
-                    <a href="<?php printf('../?action=news&id=%d&artlang=%s', $faqComment->getRecordId(), $faqLangCode) ?>">
+                    <?= $date->format(date('Y-m-d H:i', $newsComment->getDate())) ?> |
+                    <a href="<?php printf('../?action=news&id=%d&artlang=%s', $newsComment->getRecordId(), $faqLangCode) ?>">
                         <i class="fa fa-newspaper-o" aria-hidden="true"></i>
                     </a>
                 </span><br/>
                     <?= $newsComment->getComment() ?>
                 </td>

Vulnerable code:                         <?= $newsComment->getUsername() ?>
                    <?= $date->format(date('Y-m-d H:i', $faqComment->getDate())) ?> |
                    <a href="<?php printf('../?action=news&id=%d&artlang=%s', $faqComment->getRecordId(), $faqLangCode) ?>">
Fixed code:                         <?= Strings::htmlentities($newsComment->getUsername()) ?>
                    <?= $date->format(date('Y-m-d H:i', $newsComment->getDate())) ?> |
                    <a href="<?php printf('../?action=news&id=%d&artlang=%s', $newsComment->getRecordId(), $faqLangCode) ?>">
CVE-2023-1760: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-03-31T02:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/src/phpMyFAQ/Helper/UserHelper.php
Commit date: 2023-02-12 20:41:36 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/src/phpMyFAQ/Helper/UserHelper.php b/phpmyfaq/src/phpMyFAQ/Helper/UserHelper.php
index 26bdfa9a5c..39b0ba1269 100644
--- a/phpmyfaq/src/phpMyFAQ/Helper/UserHelper.php
+++ b/phpmyfaq/src/phpMyFAQ/Helper/UserHelper.php
@@ -15,10 +15,11 @@
  * @since      2021-03-14
  */
 
 namespace phpMyFAQ\Helper;
 
+use phpMyFAQ\Strings;
 use phpMyFAQ\User;
 
 /**
  * Class UserHelper
  *
@@ -56,11 +57,11 @@ class UserHelper
                 $this->user->getUserById($userId);
                 $options .= sprintf(
                     '<option value="%d" %s>%s (%s)</option>',
                     $userId,
                     (($userId === $id) ? 'selected' : ''),
-                    $this->user->getUserData('display_name'),
+                    Strings::htmlentities($this->user->getUserData('display_name')),
                     $this->user->getLogin()
                 );
             }
         }
 

Vulnerable code:                     $this->user->getUserData('display_name'),
Fixed code: use phpMyFAQ\Strings;
                    Strings::htmlentities($this->user->getUserData('display_name')),
CVE-2023-1761: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-03-31T02:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/ajaxservice.php, phpmyfaq/src/phpMyFAQ/Comments.php
Commit date: 2023-02-14 20:54:44 +0100
Commit message: fix: strip tags in comments

Diff: diff --git a/phpmyfaq/ajaxservice.php b/phpmyfaq/ajaxservice.php
index 427f87a12e..dca80db2f4 100644
--- a/phpmyfaq/ajaxservice.php
+++ b/phpmyfaq/ajaxservice.php
@@ -198,11 +198,11 @@ switch ($action) {
             $commentEntity
                 ->setRecordId($id)
                 ->setType($type)
                 ->setUsername($username)
                 ->setEmail($mailer)
-                ->setComment(nl2br($comment))
+                ->setComment(nl2br(strip_tags($comment)))
                 ->setDate($_SERVER['REQUEST_TIME']);
 
             if ($oComment->addComment($commentEntity)) {
                 $emailTo = $faqConfig->getAdminEmail();
                 $title = '';
diff --git a/phpmyfaq/src/phpMyFAQ/Comments.php b/phpmyfaq/src/phpMyFAQ/Comments.php
index 695a077057..bf14602ecf 100644
--- a/phpmyfaq/src/phpMyFAQ/Comments.php
+++ b/phpmyfaq/src/phpMyFAQ/Comments.php
@@ -81,11 +81,11 @@ class Comments
             $output .= '    <div class="card">';
             $output .= '     <div class="card-header card-header-comments">';
             $output .= sprintf(
                 '<strong><a href="mailto:%s">%s</a></strong>',
                 $mail->safeEmail($item->getEmail()),
-                $item->getUsername()
+                Strings::htmlentities($item->getUsername())
             );
             $output .= sprintf(' <span class="text-muted">(%s)</span>', $date->format($item->getDate()));
             $output .= '     </div>';
             $output .= sprintf(
                 '<div class="card-body">%s</div>',

Vulnerable code:                 ->setComment(nl2br($comment))
                $item->getUsername()
Fixed code:                 ->setComment(nl2br(strip_tags($comment)))
                Strings::htmlentities($item->getUsername())
CVE-2023-1762: Improper Privilege Management (CWE-269)
value: Improper Privilege Management in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CWE description: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CVSS v3 base score: 8.8
Published: 2023-03-31T02:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/user.php
Commit date: 2023-02-14 20:47:37 +0100
Commit message: fix: privilege escalation for users with insufficient permissions

Diff: diff --git a/phpmyfaq/admin/user.php b/phpmyfaq/admin/user.php
index eba985eec7..0bd2beeba3 100755
--- a/phpmyfaq/admin/user.php
+++ b/phpmyfaq/admin/user.php
@@ -119,10 +119,14 @@ if (
             $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW);
             $userStatus = Filter::filterInput(INPUT_POST, 'user_status', FILTER_UNSAFE_RAW, $defaultUserStatus);
             $isSuperAdmin = Filter::filterInput(INPUT_POST, 'is_superadmin', FILTER_UNSAFE_RAW);
             $isSuperAdmin = $isSuperAdmin === 'on';
 
+            if (!$user->isSuperAdmin()) {
+                $isSuperAdmin = false;
+            }
+
             // Sanity check
             if (is_null($userData['email'])) {
                 $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['err_noMailAdress']);
             } else {
                 $user = new User($faqConfig);
@@ -703,10 +707,11 @@ if (
                          minlength="8" class="form-control" autocomplete="off" tabindex="5">
                 </div>
               </div>
             </div>
 
+            <?php if ($user->isSuperAdmin()) { ?>
             <div class="form-group row">
               <div class="col-lg-4"></div>
               <div class="col-lg-8">
                 <div class="form-check">
                   <input class="form-check-input" type="checkbox" id="add_user_is_superadmin" name="user_is_superadmin">
@@ -714,10 +719,11 @@ if (
                       <?= $PMF_LANG['ad_user_is_superadmin'] ?>
                   </label>
                 </div>
               </div>
             </div>
+            <?php } ?>
 
           </form>
         </div>
         <div class="modal-footer">
           <button type="button" class="btn btn-secondary" data-dismiss="modal">

Fixed code:             if (!$user->isSuperAdmin()) {
                $isSuperAdmin = false;
            }

            <?php if ($user->isSuperAdmin()) { ?>
            <?php } ?>
CVE-2023-1875: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-04-22T18:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/user.php
Commit date: 2023-03-10 12:37:58 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/user.php b/phpmyfaq/admin/user.php
index 55f95dcd8e..402b15da5d 100755
--- a/phpmyfaq/admin/user.php
+++ b/phpmyfaq/admin/user.php
@@ -112,13 +112,13 @@ if (
         $userId = Filter::filterInput(INPUT_POST, 'user_id', FILTER_VALIDATE_INT, 0);
         if ($userId === 0) {
             $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_user_error_noId']);
         } else {
             $userData = [];
-            $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_UNSAFE_RAW);
+            $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_SANITIZE_SPECIAL_CHARS);
             $userData['email'] = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
-            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW);
+            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_SANITIZE_SPECIAL_CHARS);
             $userStatus = Filter::filterInput(INPUT_POST, 'user_status', FILTER_UNSAFE_RAW, $defaultUserStatus);
             $isSuperAdmin = Filter::filterInput(INPUT_POST, 'is_superadmin', FILTER_UNSAFE_RAW);
             $isSuperAdmin = $isSuperAdmin === 'on';
 
             if (!$user->isSuperAdmin()) {

Vulnerable code:             $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_UNSAFE_RAW);
            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW);
Fixed code:             $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_SANITIZE_SPECIAL_CHARS);
            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_SANITIZE_SPECIAL_CHARS);
CVE-2023-1880: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-04-05T17:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/send2friend.php, phpmyfaq/src/phpMyFAQ/Export/Html5.php
Commit date: 2023-02-17 15:36:51 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/send2friend.php b/phpmyfaq/send2friend.php
index e656c317e1..db91d0bfc7 100644
--- a/phpmyfaq/send2friend.php
+++ b/phpmyfaq/send2friend.php
@@ -63,11 +63,11 @@ $send2friendLink = sprintf(
 
 
 $template->parse(
     'mainPageContent',
     [
-        'lang' => $faqLanguage,
+        'lang' => Strings::htmlentities($faqLanguage),
         'msgSend2Friend' => $PMF_LANG['msgSend2Friend'],
         'msgS2FReferrer' => 'link',
         'msgS2FName' => $PMF_LANG['msgS2FName'],
         'msgS2FEMail' => $PMF_LANG['msgS2FEMail'],
         'defaultContentMail' => ($user instanceof CurrentUser) ? $user->getUserData('email') : '',
diff --git a/phpmyfaq/src/phpMyFAQ/Export/Html5.php b/phpmyfaq/src/phpMyFAQ/Export/Html5.php
index c7fcc479a1..947122a6e5 100644
--- a/phpmyfaq/src/phpMyFAQ/Export/Html5.php
+++ b/phpmyfaq/src/phpMyFAQ/Export/Html5.php
@@ -20,11 +20,10 @@ namespace phpMyFAQ\Export;
 use phpMyFAQ\Category;
 use phpMyFAQ\Configuration;
 use phpMyFAQ\Date;
 use phpMyFAQ\Export;
 use phpMyFAQ\Faq;
-use phpMyFAQ\Init;
 use phpMyFAQ\Strings;
 use XMLWriter;
 
 /**
  * Class Html5
@@ -106,11 +105,11 @@ class Html5 extends Export
                     $this->xml->writeElement('h1', $this->category->getPath($data['category_id'], ' >> '));
                 }
 
                 $this->xml->startElement('h2');
                 $this->xml->writeAttribute('id', "entry-" . $data['solution_id']);
-                $this->xml->text(strip_tags($data['topic']));
+                $this->xml->text(Strings::htmlentities($data['topic']));
                 $this->xml->endElement();
                 $this->xml->startElement('p');
                 $this->xml->writeCdata(html_entity_decode($data['content'], ENT_HTML5, 'UTF-8'));
                 $this->xml->endElement();
                 $this->xml->writeElement('p', $PMF_LANG['msgAuthor'] . ': ' . $data['author_email']);

Vulnerable code:         'lang' => $faqLanguage,
use phpMyFAQ\Init;
                $this->xml->text(strip_tags($data['topic']));
Fixed code:         'lang' => Strings::htmlentities($faqLanguage),
                $this->xml->text(Strings::htmlentities($data['topic']));
CVE-2023-1885: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-04-05T17:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/category.main.php
Commit date: 2023-02-14 18:47:29 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/category.main.php b/phpmyfaq/admin/category.main.php
index d55552c716..8e7c3cb706 100644
--- a/phpmyfaq/admin/category.main.php
+++ b/phpmyfaq/admin/category.main.php
@@ -19,10 +19,11 @@ use phpMyFAQ\Category;
 use phpMyFAQ\Category\CategoryImage;
 use phpMyFAQ\Category\CategoryPermission;
 use phpMyFAQ\Category\CategoryRelation;
 use phpMyFAQ\Database;
 use phpMyFAQ\Filter;
+use phpMyFAQ\Strings;
 
 if (!defined('IS_VALID_PHPMYFAQ')) {
     http_response_code(400);
     exit();
 }
@@ -317,13 +318,14 @@ if (!defined('IS_VALID_PHPMYFAQ')) {
 
             echo '<div class="list-group list-group-root">';
             foreach ($category->getCategoryTree() as $id => $cat) {
                 // CategoryHelper translated in this language?
                 if ($cat['lang'] == $lang) {
-                    $categoryName = $cat['name'];
+                    $categoryName = Strings::htmlentities($cat['name']);
                 } else {
-                    $categoryName = $cat['name'] . ' (' . $languageCodes[strtoupper($cat['lang'])] . ')';
+                    $categoryName = Strings::htmlentities($cat['name']) .
+                        ' (' . $languageCodes[strtoupper($cat['lang'])] . ')';
                 }
 
 
                 // Has permissions, show lock icon
                 if ($categoryPermission->isRestricted($cat['id'])) {

Vulnerable code:                     $categoryName = $cat['name'];
                    $categoryName = $cat['name'] . ' (' . $languageCodes[strtoupper($cat['lang'])] . ')';
Fixed code: use phpMyFAQ\Strings;
                    $categoryName = Strings::htmlentities($cat['name']);
                    $categoryName = Strings::htmlentities($cat['name']) .
                        ' (' . $languageCodes[strtoupper($cat['lang'])] . ')';
CVE-2023-1887: Business Logic Errors (CWE-840)
value: Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CWE description: Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
CVSS v3 base score: 4.3
Published: 2023-04-05T17:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/record.add.php
Commit date: 2023-02-16 07:22:58 +0100
Commit message: fix: corrected wrong check on user permission

Diff: diff --git a/phpmyfaq/admin/record.add.php b/phpmyfaq/admin/record.add.php
index c3d5baa054..c93cca749e 100644
--- a/phpmyfaq/admin/record.add.php
+++ b/phpmyfaq/admin/record.add.php
@@ -6,16 +6,16 @@
  *
  * This Source Code Form is subject to the terms of the Mozilla Public License,
  * v. 2.0. If a copy of the MPL was not distributed with this file, You can
  * obtain one at http://mozilla.org/MPL/2.0/.
  *
- * @package phpMyFAQ
- * @author Thorsten Rinne <thorsten@phpmyfaq.de>
+ * @package   phpMyFAQ
+ * @author    Thorsten Rinne <thorsten@phpmyfaq.de>
  * @copyright 2003-2022 phpMyFAQ Team
- * @license http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
- * @link https://www.phpmyfaq.de
- * @since 2003-02-23
+ * @license   http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
+ * @link      https://www.phpmyfaq.de
+ * @since     2003-02-23
  */
 
 use Abraham\TwitterOAuth\TwitterOAuth;
 use phpMyFAQ\Category;
 use phpMyFAQ\Category\CategoryPermission;
@@ -39,11 +39,11 @@ use phpMyFAQ\Visits;
 if (!defined('IS_VALID_PHPMYFAQ')) {
     http_response_code(400);
     exit();
 }
 
-if ($user->perm->hasPermission($user->getUserId(), 'edit_faq') || $user->perm->hasPermission($user->getUserId(), 'add_faq')) {
+if ($user->perm->hasPermission($user->getUserId(), 'add_faq')) {
     // FAQ data
     $dateStart = Filter::filterInput(INPUT_POST, 'dateStart', FILTER_UNSAFE_RAW);
     $dateEnd = Filter::filterInput(INPUT_POST, 'dateEnd', FILTER_UNSAFE_RAW);
     $question = Filter::filterInput(INPUT_POST, 'question', FILTER_UNSAFE_RAW);
     $categories = Filter::filterInputArray(

Vulnerable code:  * @package phpMyFAQ
 * @author Thorsten Rinne <thorsten@phpmyfaq.de>
 * @license http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
 * @link https://www.phpmyfaq.de
 * @since 2003-02-23
if ($user->perm->hasPermission($user->getUserId(), 'edit_faq') || $user->perm->hasPermission($user->getUserId(), 'add_faq')) {
Fixed code:  * @package   phpMyFAQ
 * @author    Thorsten Rinne <thorsten@phpmyfaq.de>
 * @license   http://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
 * @link      https://www.phpmyfaq.de
 * @since     2003-02-23
if ($user->perm->hasPermission($user->getUserId(), 'add_faq')) {
CVE-2023-2427: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-05-05T19:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/src/phpMyFAQ/Tags.php
Commit date: 2023-04-06 16:11:35 +0200
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/src/phpMyFAQ/Tags.php b/phpmyfaq/src/phpMyFAQ/Tags.php
index 11ae448a05..7f9a72ac86 100644
--- a/phpmyfaq/src/phpMyFAQ/Tags.php
+++ b/phpmyfaq/src/phpMyFAQ/Tags.php
@@ -29,16 +29,16 @@ use phpMyFAQ\Entity\TagEntity as EntityTags;
 class Tags
 {
     /**
      * @var Configuration
      */
-    private $config;
+    private Configuration $config;
 
     /**
      * @var array<int, string>
      */
-    private $recordsByTagName = [];
+    private array $recordsByTagName = [];
 
     /**
      * Constructor.
      *
      * @param Configuration $config
@@ -57,15 +57,15 @@ class Tags
     public function getAllLinkTagsById(int $recordId): string
     {
         $tagListing = '';
 
         foreach ($this->getAllTagsById($recordId) as $taggingId => $taggingName) {
-            $title = Strings::htmlspecialchars($taggingName, ENT_QUOTES, 'utf-8');
+            $title = Strings::htmlentities($taggingName);
             $url = sprintf('%sindex.php?action=search&amp;tagging_id=%d', $this->config->getDefaultUrl(), $taggingId);
             $oLink = new Link($url, $this->config);
-            $oLink->itemTitle = $taggingName;
-            $oLink->text = $taggingName;
+            $oLink->itemTitle = $title;
+            $oLink->text = $title;
             $oLink->tooltip = $title;
             $tagListing .= $oLink->toHtmlAnchor() . ', ';
         }
 
         return '' == $tagListing ? '-' : Strings::substr($tagListing, 0, -2);

Vulnerable code:     private $config;
    private $recordsByTagName = [];
            $title = Strings::htmlspecialchars($taggingName, ENT_QUOTES, 'utf-8');
            $oLink->itemTitle = $taggingName;
            $oLink->text = $taggingName;
Fixed code:     private Configuration $config;
    private array $recordsByTagName = [];
            $title = Strings::htmlentities($taggingName);
            $oLink->itemTitle = $title;
            $oLink->text = $title;
CVE-2023-2429: Improper Access Control (CWE-284)
value: Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 9.8
Published: 2023-04-30T03:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/ajaxservice.php, phpmyfaq/src/phpMyFAQ/User.php
Commit date: 2023-04-12 14:08:17 +0200
Commit message: fix: avoid possible email address manipulation

Diff: diff --git a/phpmyfaq/ajaxservice.php b/phpmyfaq/ajaxservice.php
index ccb3c3e3c27..9b123a0b127 100644
--- a/phpmyfaq/ajaxservice.php
+++ b/phpmyfaq/ajaxservice.php
@@ -772,10 +772,15 @@ switch ($action) {
         if ($password !== $confirm) {
             $message = ['error' => $PMF_LANG['ad_user_error_passwordsDontMatch']];
             break;
         }
 
+        if ($userId !== $user->getUserIdByEmail($email)) {
+            $message = ['error' => 'User ID / email mismatch!'];
+            break;
+        }
+
         if (strlen($password) <= 7 || strlen($confirm) <= 7) {
             $message = ['error' => $PMF_LANG['ad_passwd_fail']];
             break;
         } else {
             $userData = [
diff --git a/phpmyfaq/src/phpMyFAQ/User.php b/phpmyfaq/src/phpMyFAQ/User.php
index 2ad5324322f..f82f8eff77f 100644
--- a/phpmyfaq/src/phpMyFAQ/User.php
+++ b/phpmyfaq/src/phpMyFAQ/User.php
@@ -906,11 +906,11 @@ class User
             $this->userdata = new UserData($this->config);
         }
 
         $userData = $this->userdata->fetchAll('email', $email);
 
-        return (int)$userData['user_id'];
+        return $userData['user_id'];
     }
 
     /**
      * Returns true or false for the visibility for the given email
      * address, if the user is not a registered user, the method

Vulnerable code:         return (int)$userData['user_id'];
Fixed code:         if ($userId !== $user->getUserIdByEmail($email)) {
            $message = ['error' => 'User ID / email mismatch!'];
            break;
        }

        return $userData['user_id'];