CVE-2022-0912: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 4.8
Published: 2022-03-11T10:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/functions/plupload.php, src/MicroweberPackages/Utils/System/Files.php, src/MicroweberPackages/Utils/Zip/Unzip.php
Commit date: 2022-03-10 11:42:13 +0200
Commit message: update

Diff: diff --git a/src/MicroweberPackages/App/functions/plupload.php b/src/MicroweberPackages/App/functions/plupload.php
index f37a3a10621e..804f29f9683a 100644
--- a/src/MicroweberPackages/App/functions/plupload.php
+++ b/src/MicroweberPackages/App/functions/plupload.php
@@ -147,17 +147,19 @@ if ($allowed_to_upload == false) {
                         if (trim($allowed_file_type_item) != '' and $fileName_ext != '') {
                             $is_ext = get_file_extension($fileName_ext);
                             $is_ext = strtolower($is_ext);
 
                             switch ($is_ext) {
+                                case 'phtml':
                                 case 'php':
                                 case 'php12':
                                 case 'php11':
                                 case 'php10':
                                 case 'php9':
                                 case 'php8':
                                 case 'php7':
+                                case 'php6':
                                 case 'php5':
                                 case 'php4':
                                 case 'php3':
                                 case 'ptml':
                                 case 'html':
diff --git a/src/MicroweberPackages/Utils/System/Files.php b/src/MicroweberPackages/Utils/System/Files.php
index 220d42fdf0a1..037f5950017b 100644
--- a/src/MicroweberPackages/Utils/System/Files.php
+++ b/src/MicroweberPackages/Utils/System/Files.php
@@ -561,12 +561,14 @@ class Files
     function get_dangerous_files_extentions()
     {
 
 
         $dangerous = array(
+            'phtml',
             'php',
             'php5',
+            'php6',
             'php7',
             'php72',
             'php73',
             'php74',
             'php8',
diff --git a/src/MicroweberPackages/Utils/Zip/Unzip.php b/src/MicroweberPackages/Utils/Zip/Unzip.php
index f478ac359e79..d4aff764dd8c 100644
--- a/src/MicroweberPackages/Utils/Zip/Unzip.php
+++ b/src/MicroweberPackages/Utils/Zip/Unzip.php
@@ -157,12 +157,10 @@ class Unzip
                             if (!@mkdir_recursive($this->_target_dir . '/' . $str)) {
                                 $this->set_error('Desitnation path is not writable.');
                                 $resp = array('error' => 'Error with the unzip! Desitnation path is not writable.');
 
                                 return $resp;
-
-                                return false;
                             }
 
                             // Apply chmod if configured to do so
                             $this->apply_chmod && chmod($this->_target_dir . '/' . $str, $this->apply_chmod);
                         }

Vulnerable code: 
                                return false;
Fixed code:                                 case 'phtml':
                                case 'php6':
            'phtml',
            'php6',