CVE-2023-5227: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted Upload of File with Dangerous Type in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2023-09-30T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/src/phpMyFAQ/Category/CategoryImage.php
Commit date: 2023-09-01 19:49:28 +0200
Commit message: feat: added check for valid image MIME types

Diff: diff --git a/phpmyfaq/src/phpMyFAQ/Category/CategoryImage.php b/phpmyfaq/src/phpMyFAQ/Category/CategoryImage.php
index b5aabff8054..7566ac8449a 100644
--- a/phpmyfaq/src/phpMyFAQ/Category/CategoryImage.php
+++ b/phpmyfaq/src/phpMyFAQ/Category/CategoryImage.php
@@ -127,10 +127,23 @@ class CategoryImage
         ];
 
         return $mapping[$mimeType] ?? '';
     }
 
+    /**
+     * Checks for valid image MIME types, returns true if valid
+     * @param string $file
+     * @return bool
+     */
+    private function isValidMimeType(string $file): bool
+    {
+        $types = ['image/jpeg','image/gif','image/png'];
+        $type = mime_content_type($file);
+
+        return in_array($type, $types);
+    }
+
     /**
      * Uploads the current file and moves it into the images/ folder.
      *
      * @return bool
      */
@@ -138,18 +151,23 @@ class CategoryImage
     {
         if (
             $this->isUpload && is_uploaded_file($this->uploadedFile['tmp_name'])
             && $this->uploadedFile['size'] < $this->config->get('records.maxAttachmentSize')
         ) {
-            if (false === getimagesize($this->uploadedFile['tmp_name'])) {
+            if (!getimagesize($this->uploadedFile['tmp_name'])) {
+                return false;
+            }
+
+            if (!$this->isValidMimeType($this->uploadedFile['tmp_name'])) {
                 return false;
             }
-            if (move_uploaded_file($this->uploadedFile['tmp_name'], self::UPLOAD_DIR . $this->fileName)) {
-                return true;
-            } else {
+
+            if (!move_uploaded_file($this->uploadedFile['tmp_name'], self::UPLOAD_DIR . $this->fileName)) {
                 return false;
             }
+
+            return true;
         } else {
             return false;
         }
     }
 

Vulnerable code:             if (false === getimagesize($this->uploadedFile['tmp_name'])) {
            if (move_uploaded_file($this->uploadedFile['tmp_name'], self::UPLOAD_DIR . $this->fileName)) {
                return true;
            } else {
Fixed code:     /**
     * Checks for valid image MIME types, returns true if valid
     * @param string $file
     * @return bool
     */
    private function isValidMimeType(string $file): bool
    {
        $types = ['image/jpeg','image/gif','image/png'];
        $type = mime_content_type($file);

        return in_array($type, $types);
    }

            if (!getimagesize($this->uploadedFile['tmp_name'])) {
                return false;
            }

            if (!$this->isValidMimeType($this->uploadedFile['tmp_name'])) {

            if (!move_uploaded_file($this->uploadedFile['tmp_name'], self::UPLOAD_DIR . $this->fileName)) {

            return true;