CVE-2023-0790: Uncaught Exception (CWE-248)
value: Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


CWE description: An exception is thrown from a function, but it is not caught.
CVSS v3 base score: 8.8
Published: 2023-02-12T14:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/user.php
Commit date: 2023-01-25 08:11:21 +0100
Commit message: fix: added missing check on email address

Diff: diff --git a/phpmyfaq/admin/user.php b/phpmyfaq/admin/user.php
index 6a2f83ca1e..eba985eec7 100755
--- a/phpmyfaq/admin/user.php
+++ b/phpmyfaq/admin/user.php
@@ -112,45 +112,50 @@ if (
         $userId = Filter::filterInput(INPUT_POST, 'user_id', FILTER_VALIDATE_INT, 0);
         if ($userId == 0) {
             $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_user_error_noId']);
         } else {
             $userData = [];
-            $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_UNSAFE_RAW, '');
-            $userData['email'] = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL, '');
-            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW, '');
+            $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_UNSAFE_RAW);
+            $userData['email'] = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
+            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW);
             $userStatus = Filter::filterInput(INPUT_POST, 'user_status', FILTER_UNSAFE_RAW, $defaultUserStatus);
             $isSuperAdmin = Filter::filterInput(INPUT_POST, 'is_superadmin', FILTER_UNSAFE_RAW);
             $isSuperAdmin = $isSuperAdmin === 'on';
 
-            $user = new User($faqConfig);
-            $user->getUserById($userId, true);
+            // Sanity check
+            if (is_null($userData['email'])) {
+                $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['err_noMailAdress']);
+            } else {
+                $user = new User($faqConfig);
+                $user->getUserById($userId, true);
 
-            $stats = $user->getStatus();
+                $stats = $user->getStatus();
 
-            // set new password an send email if user is switched to active
-            if ($stats == 'blocked' && $userStatus == 'active') {
-                if (!$user->activateUser()) {
-                    $userStatus = 'invalid_status';
+                // set new password an send email if user is switched to active
+                if ($stats == 'blocked' && $userStatus == 'active') {
+                    if (!$user->activateUser()) {
+                        $userStatus = 'invalid_status';
+                    }
                 }
-            }
-
-            // Set super-admin flag
-            $user->setSuperAdmin($isSuperAdmin);
 
-            if (
-                !$user->userdata->set(array_keys($userData), array_values($userData)) ||
-                !$user->setStatus($userStatus)
-            ) {
-                $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_msg_mysqlerr']);
-            } else {
-                $message .= sprintf(
-                    '<p class="alert alert-success">%s <strong>%s</strong> %s</p>',
-                    $PMF_LANG['ad_msg_savedsuc_1'],
-                    Strings::htmlentities($user->getLogin(), ENT_QUOTES),
-                    $PMF_LANG['ad_msg_savedsuc_2']
-                );
-                $message .= '<script>updateUser(' . $userId . ');</script>';
+                // Set super-admin flag
+                $user->setSuperAdmin($isSuperAdmin);
+
+                if (
+                    !$user->userdata->set(array_keys($userData), array_values($userData)) ||
+                    !$user->setStatus($userStatus)
+                ) {
+                    $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_msg_mysqlerr']);
+                } else {
+                    $message .= sprintf(
+                        '<p class="alert alert-success">%s <strong>%s</strong> %s</p>',
+                        $PMF_LANG['ad_msg_savedsuc_1'],
+                        Strings::htmlentities($user->getLogin(), ENT_QUOTES),
+                        $PMF_LANG['ad_msg_savedsuc_2']
+                    );
+                    $message .= '<script>updateUser(' . $userId . ');</script>';
+                }
             }
         }
     }
 
     // delete user confirmation

Vulnerable code:             $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_UNSAFE_RAW, '');
            $userData['email'] = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL, '');
            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW, '');
            $user = new User($faqConfig);
            $user->getUserById($userId, true);
            $stats = $user->getStatus();
            // set new password an send email if user is switched to active
            if ($stats == 'blocked' && $userStatus == 'active') {
                if (!$user->activateUser()) {
                    $userStatus = 'invalid_status';
            }

            // Set super-admin flag
            $user->setSuperAdmin($isSuperAdmin);
            if (
                !$user->userdata->set(array_keys($userData), array_values($userData)) ||
                !$user->setStatus($userStatus)
            ) {
                $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_msg_mysqlerr']);
            } else {
                $message .= sprintf(
                    '<p class="alert alert-success">%s <strong>%s</strong> %s</p>',
                    $PMF_LANG['ad_msg_savedsuc_1'],
                    Strings::htmlentities($user->getLogin(), ENT_QUOTES),
                    $PMF_LANG['ad_msg_savedsuc_2']
                );
                $message .= '<script>updateUser(' . $userId . ');</script>';
Fixed code:             $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_UNSAFE_RAW);
            $userData['email'] = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW);
            // Sanity check
            if (is_null($userData['email'])) {
                $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['err_noMailAdress']);
            } else {
                $user = new User($faqConfig);
                $user->getUserById($userId, true);
                $stats = $user->getStatus();
                // set new password an send email if user is switched to active
                if ($stats == 'blocked' && $userStatus == 'active') {
                    if (!$user->activateUser()) {
                        $userStatus = 'invalid_status';
                    }
                // Set super-admin flag
                $user->setSuperAdmin($isSuperAdmin);

                if (
                    !$user->userdata->set(array_keys($userData), array_values($userData)) ||
                    !$user->setStatus($userStatus)
                ) {
                    $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_msg_mysqlerr']);
                } else {
                    $message .= sprintf(
                        '<p class="alert alert-success">%s <strong>%s</strong> %s</p>',
                        $PMF_LANG['ad_msg_savedsuc_1'],
                        Strings::htmlentities($user->getLogin(), ENT_QUOTES),
                        $PMF_LANG['ad_msg_savedsuc_2']
                    );
                    $message .= '<script>updateUser(' . $userId . ');</script>';
                }