CVE-2022-0968: Integer Overflow or Wraparound (CWE-190)
value: The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 5.5
Published: 2022-03-15T16:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php, src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php
Commit date: 2022-03-14 17:37:21 +0200
Commit message: user update requrest validation

Diff: diff --git a/src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php b/src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php
index 5b410e3a7743..529ab66c4c2f 100644
--- a/src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php
+++ b/src/MicroweberPackages/User/Http/Requests/UserCreateRequest.php
@@ -12,12 +12,15 @@ class UserCreateRequest extends FormRequest
      * @return array
      */
     public function rules()
     {
         $rules = [
-             'username' => 'required|unique:users,username',
-             'email' => 'unique:users,email',
+             'first_name'=>'max:500',
+             'last_name'=>'max:500',
+             'phone'=>'max:500',
+             'username' => 'required|unique:users,username|max:500',
+             'email' => 'unique:users,email|max:500',
         ];
 
         return $rules;
     }
 }
diff --git a/src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php b/src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php
index dab06e2b06ac..d189305fee5d 100644
--- a/src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php
+++ b/src/MicroweberPackages/User/Http/Requests/UserUpdateRequest.php
@@ -17,16 +17,20 @@ class UserUpdateRequest extends FormRequest
     {
 
         $ignore = Rule::unique('users')->ignore($this->id ?? 0, 'id');
 
         return [
+            'first_name'=>'max:500',
+            'last_name'=>'max:500',
+            'phone'=>'max:500',
             'email' => [
                 $ignore,
+                'max:500'
             ],
             'username' => [
                 $ignore,
+                'max:500'
             ],
-
         ];
 
     }
 }

Vulnerable code:              'username' => 'required|unique:users,username',
             'email' => 'unique:users,email',

Fixed code:              'first_name'=>'max:500',
             'last_name'=>'max:500',
             'phone'=>'max:500',
             'username' => 'required|unique:users,username|max:500',
             'email' => 'unique:users,email|max:500',
            'first_name'=>'max:500',
            'last_name'=>'max:500',
            'phone'=>'max:500',
                'max:500'
                'max:500'