CVE-2019-12530: Improper Authentication (CWE-287)
value: Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2019-06-02T17:29Z
Repository: https://github.com/stdonato/glpi-dashboard
Language: PHP
Files changed: front/sh/df.php, front/sh/issue.php, front/sh/load.php, front/sh/media.php, front/sh/mem.php, front/sh/traf.php, front/sh/uptime.php
Commit date: 2019-05-29 20:31:43 -0400
Commit message: 0.9.8.rc1

Diff: diff --git a/front/sh/df.php b/front/sh/df.php
index 6994861..0f05252 100644
--- a/front/sh/df.php
+++ b/front/sh/df.php
@@ -1,7 +1,10 @@
 <?php
 
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
+
 $disk = exec('/bin/df -hm |grep sd | awk \'{print $1","$2","$3","$4","$5","$6}\'', $result);
 $count = exec('/bin/df -h |grep sd | awk \'{print $1","$2","$3","$4","$5","$6}\' |wc -l');
 
 if($count == 1) {
 
diff --git a/front/sh/index.html b/front/sh/index.html
new file mode 100644
index 0000000..e69de29
diff --git a/front/sh/issue.php b/front/sh/issue.php
index a977b10..f1554ab 100644
--- a/front/sh/issue.php
+++ b/front/sh/issue.php
@@ -1,8 +1,9 @@
 <?php
 
-//header('Content-Type: application/json; charset=UTF-8');
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
 
 if(file_exists('/usr/bin/lsb_release')) {
 	echo substr(shell_exec('/usr/bin/lsb_release -ds'),0,21); //ubuntu - debian
 	}
 
diff --git a/front/sh/load.php b/front/sh/load.php
index 5f3a39f..557915d 100644
--- a/front/sh/load.php
+++ b/front/sh/load.php
@@ -1,16 +1,16 @@
 <?php
 
-// /bin/cat /proc/loadavg | /usr/bin/awk '{print $1","$2","$3}'
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
 
 $cores = exec('/bin/grep -c ^processor /proc/cpuinfo');
 
 $loadavg = exec('/bin/cat /proc/loadavg | /usr/bin/awk \'{print $2}\'');
 
 $load = round(($loadavg*100)/$cores ,1);
 
-//$load = $perc;	
 
 if($cores == 1) {
 	$ncores = '1 core'; }
 else {
 	$ncores = $cores.' cores'; }	
diff --git a/front/sh/media.php b/front/sh/media.php
index 5b4ab79..3086977 100644
--- a/front/sh/media.php
+++ b/front/sh/media.php
@@ -6,13 +6,10 @@ include (GLPI_ROOT . "/inc/config.php");
 global $DB;
 
 Session::checkLoginUser();
 Session::checkRight("profile", READ);
 
-//$ver = explode(" ",implode(" ",plugin_version_dashboard()));
-
-
 // count years	
 $query_y = "SELECT DISTINCT DATE_FORMAT( date, '%Y' ) AS year
 FROM glpi_tickets
 WHERE glpi_tickets.is_deleted = '0'
 AND date IS NOT NULL
diff --git a/front/sh/mem.php b/front/sh/mem.php
index 618c9b2..01cc61b 100644
--- a/front/sh/mem.php
+++ b/front/sh/mem.php
@@ -1,7 +1,10 @@
 <?php
 
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
+
 $totalm = exec('/usr/bin/free -tm | /usr/bin/awk \'{print $1","$2","$3-$6-$7","$4+$6+$7}\' |grep -i mem: |cut -f2 -d,');
 
 $usedm = exec('/usr/bin/free -tm | /usr/bin/awk \'{print $1","$2","$3","$4+$6+$7}\' |grep -i mem: |cut -f3 -d,');
 //$usedm = exec('/usr/bin/free -tm | /usr/bin/awk \'{print $1","$2","$3-$6-$7","$4+$6+$7}\' |grep -i mem: |cut -f3 -d,');
 
diff --git a/front/sh/traf.php b/front/sh/traf.php
index b6b054d..893e273 100644
--- a/front/sh/traf.php
+++ b/front/sh/traf.php
@@ -1,7 +1,10 @@
 <?php
 
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
+
 	 $interval = 2;	
 		
     $tx_path = 'cat /sys/class/net/eth0/statistics/tx_bytes';
     $rx_path = 'cat /sys/class/net/eth0/statistics/rx_bytes';
 
diff --git a/front/sh/uptime.php b/front/sh/uptime.php
index 5f581cf..b7cde5b 100644
--- a/front/sh/uptime.php
+++ b/front/sh/uptime.php
@@ -1,17 +1,25 @@
 <?php
 
-$totalSeconds1 = shell_exec("/usr/bin/cut -d. -f1 /proc/uptime");
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
+
+$uptime = shell_exec('uptime |cut -d" " -f4-8');
+
+echo $uptime;
+
+/*$totalSeconds1 = shell_exec("/usr/bin/cut -d'.' -f1 /proc/uptime");
 $totalSeconds = strtotime($totalSeconds1);
 $totalMin   = $totalSeconds / 60;
 $totalHours = $totalMin / 60;
 
 $days  = floor($totalHours / 24);
 $hours = floor($totalHours - ($days * 24));
 $min   = floor($totalMin - ($days * 60 * 24) - ($hours * 60));
 
 $formatUptime = '';
+
 if ($days != 0) {
     $formatUptime .= "$days d ";
 }
 
 if ($hours != 0) {
@@ -20,7 +28,8 @@ if ($hours != 0) {
 
 if ($min != 0) {
     $formatUptime .= "$min m";
 }
 
-//header('Content-Type: application/json; charset=UTF-8');
-echo ($formatUptime);
+echo ($formatUptime);*/
+
+?>
\ No newline at end of file

Vulnerable code: //header('Content-Type: application/json; charset=UTF-8');
// /bin/cat /proc/loadavg | /usr/bin/awk '{print $1","$2","$3}'
//$load = $perc;	
//$ver = explode(" ",implode(" ",plugin_version_dashboard()));


$totalSeconds1 = shell_exec("/usr/bin/cut -d. -f1 /proc/uptime");
//header('Content-Type: application/json; charset=UTF-8');
echo ($formatUptime);
Fixed code: Session::checkLoginUser();
Session::checkRight("profile", READ);

Session::checkLoginUser();
Session::checkRight("profile", READ);
Session::checkLoginUser();
Session::checkRight("profile", READ);
Session::checkLoginUser();
Session::checkRight("profile", READ);

Session::checkLoginUser();
Session::checkRight("profile", READ);

Session::checkLoginUser();
Session::checkRight("profile", READ);

$uptime = shell_exec('uptime |cut -d" " -f4-8');

echo $uptime;

/*$totalSeconds1 = shell_exec("/usr/bin/cut -d'.' -f1 /proc/uptime");

echo ($formatUptime);*/

?>