CVE-2023-0565: Business Logic Errors (CWE-840)
value: Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.


CWE description: Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
CVSS v3 base score: 4.9
Published: 2023-01-29T22:15Z
Repository: https://github.com/froxlor/froxlor
Language: PHP
Files changed: admin_templates.php, lng/de.lng.php, lng/en.lng.php
Commit date: 2023-01-28 12:16:40 +0100
Commit message: validate existence of language in admin-templates

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/admin_templates.php b/admin_templates.php
index 1f6e7a6c4c..a8cc334eff 100644
--- a/admin_templates.php
+++ b/admin_templates.php
@@ -251,10 +251,13 @@ if ($action == '') {
 	}
 } elseif ($action == 'add') {
 	if (isset($_POST['prepare']) && $_POST['prepare'] == 'prepare') {
 		// email templates
 		$language = htmlentities(Validate::validate($_POST['language'], 'language', '/^[^\r\n\0"\']+$/', 'nolanguageselect'));
+		if (!array_key_exists($language, $languages)) {
+			Response::standardError('templatelanguageinvalid');
+		}
 		$template = Validate::validate($_POST['template'], 'template');
 
 		$result_stmt = Database::prepare("
 			SELECT COUNT(*) as def FROM `" . TABLE_PANEL_TEMPLATES . "`
 			WHERE `adminid` = :adminid AND `language` = :lang
@@ -286,10 +289,13 @@ if ($action == '') {
 			'replacers' => $template_add_data['template_replacers']
 		]);
 	} elseif (isset($_POST['send']) && $_POST['send'] == 'send' && !isset($_POST['filesend'])) {
 		// email templates
 		$language = htmlentities(Validate::validate($_POST['language'], 'language', '/^[^\r\n\0"\']+$/', 'nolanguageselect'));
+		if (!array_key_exists($language, $languages)) {
+			Response::standardError('templatelanguageinvalid');
+		}
 		$template = Validate::validate($_POST['template'], 'template');
 		$subject = Validate::validate($_POST['subject'], 'subject', '/^[^\r\n\0]+$/', 'nosubjectcreate');
 		$mailbody = Validate::validate($_POST['mailbody'], 'mailbody', '/^[^\0]+$/', 'nomailbodycreate');
 		$templates = [];
 		$result_stmt = Database::prepare("
diff --git a/lng/de.lng.php b/lng/de.lng.php
index 25282a0d47..49c2055040 100644
--- a/lng/de.lng.php
+++ b/lng/de.lng.php
@@ -771,10 +771,11 @@ return [
 		'destinationalreadyexistasmail' => 'Die Weiterleitung zu "%s" existiert bereits als aktive E-Mail-Adresse.',
 		'destinationalreadyexist' => 'Es existiert bereits eine Weiterleitung nach "%s".',
 		'destinationiswrong' => 'Die Weiterleitungsadresse "%s" enthält ungültige Zeichen oder ist nicht vollständig.',
 		'backupfoldercannotbedocroot' => 'Der Ordner für Backups darf nicht das Heimatverzeichnis sein, wählen Sie einen Ordner unterhalb des Heimatverzeichnisses, z.B. /backups',
 		'templatelanguagecombodefined' => 'Die gewählte Kombination aus Sprache und Vorlage ist bereits definiert.',
+		'templatelanguageinvalid' => 'Die gewählte Sprache existiert nicht',
 		'ipstillhasdomains' => 'Die IP/Port-Kombination, die Sie löschen wollen, ist noch bei einer oder mehreren Domains eingetragen. Bitte ändern Sie die Domains vorher auf eine andere IP/Port-Kombination, um diese löschen zu können.',
 		'cantdeletedefaultip' => 'Sie können die Standard-IP/Port-Kombination für Reseller nicht löschen. Bitte setzen Sie eine andere IP/Port-Kombination als Standard, um diese löschen zu können.',
 		'cantdeletesystemip' => 'Sie können die letzte System-IP-Adresse nicht löschen. Entweder legen Sie eine neue IP/Port-Kombination an oder Sie ändern die System-IP-Adresse.',
 		'myipaddress' => '\'IP-Adresse\'',
 		'myport' => '\'Port\'',
diff --git a/lng/en.lng.php b/lng/en.lng.php
index 776dcddf19..815144698e 100644
--- a/lng/en.lng.php
+++ b/lng/en.lng.php
@@ -837,10 +837,11 @@ return [
 		'destinationalreadyexistasmail' => 'The forwarder to %s already exists as active email-address.',
 		'destinationalreadyexist' => 'You have already defined a forwarder to "%s"',
 		'destinationiswrong' => 'The forwarder %s contains invalid character(s) or is incomplete.',
 		'backupfoldercannotbedocroot' => 'The folder for backups cannot be your homedir, please chose a folder within your homedir, e.g. /backups',
 		'templatelanguagecombodefined' => 'The selected language/template combination has already been defined.',
+		'templatelanguageinvalid' => 'The selected language does not exist',
 		'ipstillhasdomains' => 'The IP/Port combination you want to delete still has domains assigned to it, please reassign those to other IP/Port combinations before deleting this IP/Port combination.',
 		'cantdeletedefaultip' => 'You cannot delete the default IP/Port combination, please make another IP/Port combination default for before deleting this IP/Port combination.',
 		'cantdeletesystemip' => 'You cannot delete the last system IP, either create a new IP/Port combination for the system IP or change the system IP.',
 		'myipaddress' => '\'IP\'',
 		'myport' => '\'Port\'',

Fixed code: 		if (!array_key_exists($language, $languages)) {
			Response::standardError('templatelanguageinvalid');
		}
		if (!array_key_exists($language, $languages)) {
			Response::standardError('templatelanguageinvalid');
		}
		'templatelanguageinvalid' => 'Die gewählte Sprache existiert nicht',
		'templatelanguageinvalid' => 'The selected language does not exist',