CVE-2015-10057: Improper Access Control (CWE-284)
value: A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 07ba8273a9311d1383f3686ac7cb32f20770ab1e. It is recommended to upgrade the affected component. The identifier VDB-218401 was assigned to this vulnerability.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 9.8
Published: 2023-01-16T19:15Z
Repository: https://github.com/little-apps/little-software-stats
Language: PHP
Files changed: inc/class.securelogin.php, login.php
Commit date: 2015-09-26 16:21:48 -0600
Commit message: fixed security vulnerability allowing an attacker that knows the username to change the password without an activation key

Diff: diff --git a/inc/class.securelogin.php b/inc/class.securelogin.php
index cee7b30..0e24b89 100644
--- a/inc/class.securelogin.php
+++ b/inc/class.securelogin.php
@@ -211,10 +211,13 @@ class SecureLogin {
         // Trim parameters, also convert user and key to lowercase
         $user = strtolower( trim( $user ) );
         $pass = trim( $pass );
         $pass2 = trim( $pass2 );
         $key = strtolower( trim( $key ) );
+        
+        if ( empty( $key ) )
+        	return __( "Activation key cannot be empty" );
 
         if ( !MySQL::getInstance()->select( "users", array( "UserName" => $user ), "", "0,1" ) )
             return __( "Username does not exist" );
 
         if ( !MySQL::getInstance()->select( "users", array( "UserName" => $user, "ActivateKey" => $key ), "", "0,1" ) )
diff --git a/login.php b/login.php
index 040a6ec..9a61a07 100644
--- a/login.php
+++ b/login.php
@@ -140,14 +140,14 @@ if ( isset( $_POST['submitBtn'] ) ) {
                     </div>
                 <?php endif; ?>
                 <!--  end message -->
                 
 		<!--  start login-inner -->
-                <?php if ( ( isset( $_GET['action'] ) ) && $_GET['action'] == "resetPwd") : ?>		
+                <?php if ( ( isset( $_GET['action'] ) ) && $_GET['action'] == "resetPwd" && !empty( $_GET['key'] ) ) : ?>		
 		<div id="login-inner">
                     <form action="#" method="post">
-                        <input name="key" type="hidden" value="<?php echo ( ( isset( $_GET['key'] ) ) ? ( $_GET['key'] ) : ( '' ) ); ?>" />
+                        <input name="key" type="hidden" value="<?php echo $_GET['key']; ?>" />
                         <table border="0" cellpadding="0" cellspacing="0">
                             <tr>
                                 <th><?php _e ( 'Username' ); ?></th>
                                 <td><input name="username" type="text" class="login-inp" value="<?php echo ( ( isset( $_GET['login'] ) ) ? ( $_GET['login'] ) : ( '' ) ); ?>" /></td>
                             </tr>

Vulnerable code:                 <?php if ( ( isset( $_GET['action'] ) ) && $_GET['action'] == "resetPwd") : ?>		
                        <input name="key" type="hidden" value="<?php echo ( ( isset( $_GET['key'] ) ) ? ( $_GET['key'] ) : ( '' ) ); ?>" />
Fixed code:         
        if ( empty( $key ) )
        	return __( "Activation key cannot be empty" );
                <?php if ( ( isset( $_GET['action'] ) ) && $_GET['action'] == "resetPwd" && !empty( $_GET['key'] ) ) : ?>		
                        <input name="key" type="hidden" value="<?php echo $_GET['key']; ?>" />