Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2018-25096: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 0.4-alpha is able to address this issue. The patch is named 58b413aa40820b49070782c786c526850ab7748f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249191.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-12-30T10:15Z
Repository: https://github.com/MdAlAmin-aol/ownhealthrecord
Language: PHP
Files changed: includes/logout.php
Commit date: 2018-11-16 17:23:31 +0100
Commit message: added CSRF check and fixed broken redirect link from login.php to index.php

Diff: diff --git a/includes/logout.php b/includes/logout.php
index b318db9..52eabb2 100644
--- a/includes/logout.php
+++ b/includes/logout.php
@@ -14,10 +14,15 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
+ 
+ // check whether csrf token in _SESSION is valid, if not, die and stop script
+if($_POST['csrf'] !== $_SESSION['csrf_token']) {
+  die("invalid Token");
+}
 
 include_once 'functions.php';
 sec_session_start();
 
 // Unset all session values 
@@ -29,7 +34,7 @@ $params = session_get_cookie_params();
 // Delete the actual cookie. 
 setcookie(session_name(),'', time() - 42000, $params["path"], $params["domain"], $params["secure"], $params["httponly"]);
 
 // Destroy session 
 session_destroy();
-header("Location: ../login.php");
+header("Location: ../index.php");
 exit();

Vulnerable code: header("Location: ../login.php");
Fixed code:  
 // check whether csrf token in _SESSION is valid, if not, die and stop script
if($_POST['csrf'] !== $_SESSION['csrf_token']) {
  die("invalid Token");
}
header("Location: ../index.php");
CVE-2019-3559: Improper Handling of Exceptional Conditions (CWE-755)
value: Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.02.18.00.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 7.5
Published: 2019-05-06T16:29Z
Repository: https://github.com/facebook/fbthrift
Language: Java
Files changed: thrift/lib/java/thrift/src/main/java/com/facebook/thrift/protocol/TProtocolUtil.java
Commit date: 2019-02-14 14:38:42 -0800
Commit message: Throw on bad types during skipping data

Summary:
The current code silently returns on bad types. In case when we have an invalid data, we may get a container of a large size with a bad type, this would lead to us running long loop doing nothing (though we already can say that the data is invalid).

The new code would throw an exception as soon as we try to skip a value of invalid type.

Fixes CVE-2019-3552

Reviewed By: stevegury

Differential Revision: D13892370

fbshipit-source-id: 582c81f90cf40c105383083cb38815816140e3ad

Diff: diff --git a/thrift/lib/java/thrift/src/main/java/com/facebook/thrift/protocol/TProtocolUtil.java b/thrift/lib/java/thrift/src/main/java/com/facebook/thrift/protocol/TProtocolUtil.java
index f23d0a979e..a18253b1ac 100644
--- a/thrift/lib/java/thrift/src/main/java/com/facebook/thrift/protocol/TProtocolUtil.java
+++ b/thrift/lib/java/thrift/src/main/java/com/facebook/thrift/protocol/TProtocolUtil.java
@@ -164,11 +164,14 @@ public class TProtocolUtil {
         }
         prot.readListEnd();
         break;
       }
     default:
-      break;
+      {
+        throw new TProtocolException(
+              TProtocolException.INVALID_DATA, "Invalid type encountered during skipping: " + type);
+      }
     }
   }
 
   /**
    * Attempt to determine the protocol used to serialize some data.

Vulnerable code:       break;
Fixed code:       {
        throw new TProtocolException(
              TProtocolException.INVALID_DATA, "Invalid type encountered during skipping: " + type);
      }
CVE-2019-3565: Improper Handling of Exceptional Conditions (CWE-755)
value: Legacy C++ Facebook Thrift servers (using cpp instead of cpp2) would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.05.06.00.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 7.5
Published: 2019-05-06T16:29Z
Repository: https://github.com/facebook/fbthrift
Language: C
Files changed: thrift/lib/cpp/protocol/TProtocol.h
Commit date: 2019-05-02 18:55:05 -0700
Commit message: Throw on skipping an invalid type.

Summary:
Certain values (e.g.) T_STOP should not appear as a skip type. Allowing them to
can cause thrift to loop unboundedly.

Reviewed By: spalamarchuk

Differential Revision: D15102451

fbshipit-source-id: c08d52f44f37e9c212d3480233ac217105586c9f

Diff: diff --git a/thrift/lib/cpp/protocol/TProtocol.h b/thrift/lib/cpp/protocol/TProtocol.h
index 9c5d913009..273ff10be6 100644
--- a/thrift/lib/cpp/protocol/TProtocol.h
+++ b/thrift/lib/cpp/protocol/TProtocol.h
@@ -163,12 +163,13 @@ uint32_t skip(Protocol_& prot, TType arg_type) {
         }
       }
       result += prot.readListEnd();
       return result;
     }
-    default:
-      return 0;
+    default: {
+      TProtocolException::throwInvalidSkipType(arg_type);
+    }
   }
 }
 
 // TODO(denplusplus): remove.
 // DO NOT USE.

Vulnerable code:     default:
      return 0;
Fixed code:     default: {
      TProtocolException::throwInvalidSkipType(arg_type);
    }
CVE-2022-31508: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: The idayrus/evoting repository before 2022-05-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.3
Published: 2022-07-11T01:15Z
Repository: https://github.com/idayrus/evoting
Language: Unknown
Commit date: 2022-05-09 01:26:01 +0700
Commit message: Merge pull request #2 from porcupineyhairs/FixPathInjection

Fix Path Traversal Vulnerability
CVE-2021-3858: Cross-Site Request Forgery (CSRF) (CWE-352)
value: snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2021-10-19T13:15Z
Repository: https://github.com/snipe/snipe-it
Language: Unknown
Commit date: 2021-10-04 20:40:33 -0700
Commit message: Merge pull request #10165 from snipe/fixes/set_restore_actions_to_POST_requests

Set restore actions to POST requests instead of GET
CVE-2021-3863: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-10-19T13:15Z
Repository: https://github.com/snipe/snipe-it
Language: Unknown
Commit date: 2021-10-06 12:38:51 -0700
Commit message: Merge pull request #10171 from snipe/fixes/xss_svg_in_file_uploads

Fixed SVG XSS vuln
CVE-2021-3879: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-10-19T13:15Z
Repository: https://github.com/snipe/snipe-it
Language: PHP
Files changed: resources/views/partials/bootstrap-table.blade.php
Commit date: 2021-10-15 11:50:52 -0500
Commit message: Fixes possible XSS on all-file-types export

Signed-off-by: snipe <snipe@snipe.net>

Diff: diff --git a/resources/views/partials/bootstrap-table.blade.php b/resources/views/partials/bootstrap-table.blade.php
index 7ad14bf90..130bc9c2d 100644
--- a/resources/views/partials/bootstrap-table.blade.php
+++ b/resources/views/partials/bootstrap-table.blade.php
@@ -73,10 +73,14 @@
                 columns: 'fa-columns',
                 refresh: 'fa-refresh',
                 export: 'fa-download',
                 clearSearch: 'fa-times'
             },
+            exportOptions: {
+                htmlContent: true,
+            },
+
             exportTypes: ['csv', 'excel', 'doc', 'txt','json', 'xml', 'pdf'],
             onLoadSuccess: function () {
                 $('[data-toggle="tooltip"]').tooltip(); // Needed to attach tooltips after ajax call
             }
 

Fixed code:             exportOptions: {
                htmlContent: true,
            },
CVE-2021-3938: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-11-13T09:15Z
Repository: https://github.com/snipe/snipe-it
Language: Unknown
Commit date: 2021-11-08 20:32:02 -0800
Commit message: Merge pull request #10286 from uberbrady/fix_bulk_audit_xss

Escape asset_tag attribute at controller level for bulk checkout
CVE-2021-3961: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-11-19T12:15Z
Repository: https://github.com/snipe/snipe-it
Language: Unknown
Commit date: 2021-11-15 20:33:51 -0800
Commit message: Merge pull request #10315 from snipe/fixes/escape_custom_fields_in_api_response

Escape custom field values in API response
CVE-2021-4018: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-12-01T10:15Z
Repository: https://github.com/snipe/snipe-it
Language: Unknown
Commit date: 2021-11-24 19:56:36 -0800
Commit message: Merge pull request #10361 from snipe/fixes/xss_in_accessories_checkout_notes

Escape notes in transformCheckedOutAccessory
CVE-2021-4075: Server-Side Request Forgery (SSRF) (CWE-918)
value: snipe-it is vulnerable to Server-Side Request Forgery (SSRF)
CWE description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CVSS v3 base score: 7.2
Published: 2021-12-06T21:15Z
Repository: https://github.com/snipe/snipe-it
Language: Unknown
Commit date: 2021-12-06 11:41:11 -0800
Commit message: Merge pull request #10394 from snipe/fixes/add_stricter_validation_for_slack_hooks

Adds stricter validation for slack hooks
CVE-2021-4089: Missing Authorization (CWE-862)
value: snipe-it is vulnerable to Improper Access Control
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 4.3
Published: 2021-12-10T20:15Z
Repository: https://github.com/snipe/snipe-it
Language: PHP
Files changed: app/Http/Controllers/AssetModelsController.php
Commit date: 2021-12-09 21:42:18 +0800
Commit message: Update AssetModelsController.php
Diff: diff --git a/app/Http/Controllers/AssetModelsController.php b/app/Http/Controllers/AssetModelsController.php
index 05fd8257d0..8d57346079 100755
--- a/app/Http/Controllers/AssetModelsController.php
+++ b/app/Http/Controllers/AssetModelsController.php
@@ -267,11 +267,11 @@ class AssetModelsController extends Controller
     * @param int $modelId
     * @return View
     */
     public function getClone($modelId = null)
     {
-        $this->authorize('view', AssetModel::class);
+        $this->authorize('create', AssetModel::class);
         // Check if the model exists
         if (is_null($model_to_clone = AssetModel::find($modelId))) {
             return redirect()->route('models.index')->with('error', trans('admin/models/message.does_not_exist'));
         }
 

Vulnerable code:         $this->authorize('view', AssetModel::class);
Fixed code:         $this->authorize('create', AssetModel::class);
CVE-2021-4108: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-12-14T20:15Z
Repository: https://github.com/snipe/snipe-it
Language: PHP
Files changed: app/Http/Transformers/AssetsTransformer.php
Commit date: 2021-12-13 12:03:03 -0800
Commit message: Added escape to assigned_to API response

Signed-off-by: snipe <snipe@snipe.net>

Diff: diff --git a/app/Http/Transformers/AssetsTransformer.php b/app/Http/Transformers/AssetsTransformer.php
index 0da314002f..e9abca65e1 100644
--- a/app/Http/Transformers/AssetsTransformer.php
+++ b/app/Http/Transformers/AssetsTransformer.php
@@ -168,11 +168,11 @@ class AssetsTransformer
                     'type' => 'user'
                 ] : null;
         }
         return $asset->assigned ? [
             'id' => $asset->assigned->id,
-            'name' => $asset->assigned->display_name,
+            'name' => e($asset->assigned->display_name),
             'type' => $asset->assignedType()
         ] : null;
     }
 
 

Vulnerable code:             'name' => $asset->assigned->display_name,
Fixed code:             'name' => e($asset->assigned->display_name),
CVE-2022-0178: Missing Authorization (CWE-862)
value: Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.


CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.4
Published: 2022-01-13T23:15Z
Repository: https://github.com/snipe/snipe-it
Language: Unknown
Commit date: 2022-01-13 01:36:52 -0800
Commit message: Merge pull request #10504 from snipe/fixes/auth_controls_on_api_key_creation

Fixes auth controls on api key creation
CVE-2022-0179: Missing Authorization (CWE-862)
value: snipe-it is vulnerable to Missing Authorization
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.4
Published: 2022-01-12T05:15Z
Repository: https://github.com/snipe/snipe-it
Language: Unknown
Commit date: 2022-01-10 19:24:31 -0800
Commit message: Merge pull request #10498 from Haxatron/master

Fix access control
CVE-2022-0569: Observable Discrepancy (CWE-203)
value: Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.


CWE description: The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS v3 base score: 4.3
Published: 2022-02-14T12:15Z
Repository: https://github.com/snipe/snipe-it
Language: PHP
Files changed: resources/lang/en/passwords.php
Commit date: 2022-02-11 15:55:42 -0800
Commit message: Updated language string

Signed-off-by: snipe <snipe@snipe.net>

Diff: diff --git a/resources/lang/en/passwords.php b/resources/lang/en/passwords.php
index 6205ef774d..4772940015 100644
--- a/resources/lang/en/passwords.php
+++ b/resources/lang/en/passwords.php
@@ -1,6 +1,6 @@
 <?php
 
 return [
-    'sent'	        => 'Your password link has been sent!',
+    'sent'	        => 'Success: If that email address exists in our system, a password recovery email has been sent.',
     'user'			=> 'No matching active user found with that email.',
 ];

Vulnerable code:     'sent'	        => 'Your password link has been sent!',
Fixed code:     'sent'	        => 'Success: If that email address exists in our system, a password recovery email has been sent.',
CVE-2022-0579: Missing Authorization (CWE-862)
value: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.


CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 6.5
Published: 2022-02-14T19:15Z
Repository: https://github.com/snipe/snipe-it
Language: Unknown
Commit date: 2022-02-13 10:56:55 -0800
Commit message: Merge pull request #10665 from snipe/fixes/adds_gate_to_supplier_view

Adds gate to supplier
CVE-2022-0611: Missing Authorization (CWE-862)
value: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.


CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 8.8
Published: 2022-02-16T00:15Z
Repository: https://github.com/snipe/snipe-it
Language: Unknown
Commit date: 2022-02-14 15:58:19 -0800
Commit message: Merge pull request #10672 from snipe/fixes/missing_gates_for_maintenances

Added Asset edit/delete gates to maintenances
CVE-2022-0622: Generation of Error Message Containing Sensitive Information (CWE-209)
value: Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 5.3
Published: 2022-02-17T02:15Z
Repository: https://github.com/snipe/snipe-it
Language: PHP
Files changed: app/Http/Controllers/Auth/ForgotPasswordController.php
Commit date: 2022-02-15 18:09:58 -0800
Commit message: Added usleep :(

Signed-off-by: snipe <snipe@snipe.net>

Diff: diff --git a/app/Http/Controllers/Auth/ForgotPasswordController.php b/app/Http/Controllers/Auth/ForgotPasswordController.php
index 3619b4e5bfd..62798745a79 100644
--- a/app/Http/Controllers/Auth/ForgotPasswordController.php
+++ b/app/Http/Controllers/Auth/ForgotPasswordController.php
@@ -85,10 +85,12 @@ class ForgotPasswordController extends Controller
             );
         } catch(\Exception $e) {
             \Log::info('Password reset attempt: User '.$request->input('username').'failed with exception: '.$e );
         }
 
+        // Prevent timing attack to enumerate users.
+        usleep(500000 + random_int(0, 1500000));
 
         if ($response === \Password::RESET_LINK_SENT) {
             \Log::info('Password reset attempt: User '.$request->input('username').' WAS found, password reset sent');
         } else {
             \Log::info('Password reset attempt: User matching username '.$request->input('username').' NOT FOUND or user is inactive');

Fixed code:         // Prevent timing attack to enumerate users.
        usleep(500000 + random_int(0, 1500000));
CVE-2022-1380: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-16T12:15Z
Repository: https://github.com/snipe/snipe-it
Language: Unknown
Commit date: 2022-04-15 12:25:56 +0100
Commit message: Merge pull request #10942 from snipe/fixes/xss_user_requested

Fixes potential XSS vuln in user requestable results
CVE-2022-1445: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-24T15:15Z
Repository: https://github.com/snipe/snipe-it
Language: PHP
Files changed: app/Http/Transformers/DepreciationReportTransformer.php
Commit date: 2022-04-24 15:27:11 +0100
Commit message: Escape checkout target name

Signed-off-by: snipe <snipe@snipe.net>

Diff: diff --git a/app/Http/Transformers/DepreciationReportTransformer.php b/app/Http/Transformers/DepreciationReportTransformer.php
index 73c970504b0..a5fb118c403 100644
--- a/app/Http/Transformers/DepreciationReportTransformer.php
+++ b/app/Http/Transformers/DepreciationReportTransformer.php
@@ -96,11 +96,11 @@ class DepreciationReportTransformer
             'currency' => $purchase_cost_currency,
             'purchase_date' => Helper::getFormattedDateObject($asset->purchase_date, 'date'),
             'purchase_cost' => Helper::formatCurrencyOutput($asset->purchase_cost),
             'book_value' => Helper::formatCurrencyOutput($depreciated_value),
             'monthly_depreciation' => $monthly_depreciation,
-            'checked_out_to' => $checkout_target,
+            'checked_out_to' => ($checkout_target) ? e($checkout_target) : null,
             'diff' =>  Helper::formatCurrencyOutput($diff),
             'number_of_months' =>  ($asset->model && $asset->model->depreciation) ? e($asset->model->depreciation->months) : null,
             'depreciation' => (($asset->model) && ($asset->model->depreciation)) ?  e($asset->model->depreciation->name) : null,
             
 

Vulnerable code:             'checked_out_to' => $checkout_target,
Fixed code:             'checked_out_to' => ($checkout_target) ? e($checkout_target) : null,
CVE-2022-1511: Missing Authorization (CWE-862)
value: Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 6.5
Published: 2022-04-28T15:15Z
Repository: https://github.com/snipe/snipe-it
Language: PHP
Files changed: app/Http/Controllers/Assets/AssetsController.php
Commit date: 2022-04-28 15:45:37 +0100
Commit message: Added access gate to the requested assets index

Signed-off-by: snipe <snipe@snipe.net>

Diff: diff --git a/app/Http/Controllers/Assets/AssetsController.php b/app/Http/Controllers/Assets/AssetsController.php
index 069664a7f68..d0f90f9fa8f 100755
--- a/app/Http/Controllers/Assets/AssetsController.php
+++ b/app/Http/Controllers/Assets/AssetsController.php
@@ -859,10 +859,11 @@ class AssetsController extends Controller
         }
     }
 
     public function getRequestedIndex($user_id = null)
     {
+        $this->authorize('index', Asset::class);
         $requestedItems = CheckoutRequest::with('user', 'requestedItem')->whereNull('canceled_at')->with('user', 'requestedItem');
 
         if ($user_id) {
             $requestedItems->where('user_id', $user_id)->get();
         }

Fixed code:         $this->authorize('index', Asset::class);
CVE-2022-2997: Session Fixation (CWE-384)
value: Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10.
CWE description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CVSS v3 base score: 8
Published: 2022-08-25T21:15Z
Repository: https://github.com/snipe/snipe-it
Language: PHP
Files changed: app/Http/Controllers/ProfileController.php, app/Http/Kernel.php
Commit date: 2022-08-25 12:24:26 -0700
Commit message: Log user out of other devices when they change their password

Signed-off-by: snipe <snipe@snipe.net>

Diff: diff --git a/app/Http/Controllers/ProfileController.php b/app/Http/Controllers/ProfileController.php
index 14f9ba81c06..38d4226dfa7 100755
--- a/app/Http/Controllers/ProfileController.php
+++ b/app/Http/Controllers/ProfileController.php
@@ -2,11 +2,11 @@
 
 namespace App\Http\Controllers;
 
 use App\Http\Requests\ImageUploadRequest;
 use App\Models\Setting;
-use Auth;
+use Illuminate\Support\Facades\Auth;
 use Gate;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Storage;
 use Image;
@@ -131,11 +131,11 @@ class ProfileController extends Controller
      * @return View
      */
     public function password()
     {
         $user = Auth::user();
-
+        
         return view('account/change-password', compact('user'));
     }
 
     /**
      * Users change password form processing page.
@@ -184,10 +184,13 @@ class ProfileController extends Controller
         });
 
         if (! $validator->fails()) {
             $user->password = Hash::make($request->input('password'));
             $user->save();
+
+            // Log the user out of other devices
+            Auth::logoutOtherDevices($request->input('password'));
             return redirect()->route('account.password.index')->with('success', 'Password updated!');
 
         }
         return redirect()->back()->withInput()->withErrors($validator);
 
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index 10f9fd32353..36014dc7dea 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -41,10 +41,11 @@ class Kernel extends HttpKernel
             \App\Http\Middleware\CheckLocale::class,
             \App\Http\Middleware\CheckUserIsActivated::class,
             \App\Http\Middleware\CheckForTwoFactor::class,
             \Laravel\Passport\Http\Middleware\CreateFreshApiToken::class,
             \App\Http\Middleware\AssetCountForSidebar::class,
+            \Illuminate\Session\Middleware\AuthenticateSession::class,
         ],
 
         'api' => [
             'auth:api',
         ],

Vulnerable code: use Auth;

Fixed code: use Illuminate\Support\Facades\Auth;
        

            // Log the user out of other devices
            Auth::logoutOtherDevices($request->input('password'));
            \Illuminate\Session\Middleware\AuthenticateSession::class,
CVE-2020-10595: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
value: pam-krb5 before 4.9 has a buffer overflow that might cause remote code execution in situations involving supplemental prompting by a Kerberos library. It may overflow a buffer provided by the underlying Kerberos library by a single '\0' byte if an attacker responds to a prompt with an answer of a carefully chosen length. The effect may range from heap corruption to stack corruption depending on the structure of the underlying Kerberos library, with unknown effects but possibly including code execution. This code path is not used for normal authentication, but only when the Kerberos library does supplemental prompting, such as with PKINIT or when using the non-standard no_prompt PAM configuration option.
CWE description: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CVSS v3 base score: 9.8
Published: 2020-03-31T13:15Z
Repository: https://github.com/rra/pam-krb5
Language: Other
Files changed: NEWS
Commit date: 2020-03-28 20:50:51 -0700
Commit message: Add CVE for buffer overflow security fix

Diff: diff --git a/NEWS b/NEWS
index bd2d73c..1834aa3 100644
--- a/NEWS
+++ b/NEWS
@@ -3,10 +3,11 @@
 pam-krb5 4.9 (unreleased)
 
     SECURITY: All previous versions of this module could overflow the
     buffer provided by the underlying Kerberos library for the response to
     a prompt by writing a single nul character past the end of the buffer.
+    (CVE-2020-10595)
 
     Support use_pkinit with MIT Kerberos.  (Debian Bug#871699)
 
     Reject passwords as long or longer than PAM_MAX_RESP_SIZE (normally
     512 octets), since extremely long passwords can be used for a denial

Fixed code:     (CVE-2020-10595)
CVE-2017-6307: Out-of-bounds Write (CWE-787)
value: An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapi_attr.c:mapi_attr_read(). These might lead to invalid read and write operations, controlled by an attacker.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.8
Published: 2017-02-24T04:59Z
Repository: https://github.com/verdammelt/tnef
Language: C
Files changed: src/mapi_attr.c
Commit date: 2017-02-22 20:55:13 -0500
Commit message: Use asserts on lengths to prevent invalid reads/writes.

Diff: diff --git a/src/mapi_attr.c b/src/mapi_attr.c
index d85e149..08a8eff 100644
--- a/src/mapi_attr.c
+++ b/src/mapi_attr.c
@@ -172,10 +172,11 @@ mapi_attr_read (size_t len, unsigned char *buf)
 {
     size_t idx = 0;
     uint32 i,j;
     assert(len > 4);
     uint32 num_properties = GETINT32(buf+idx);
+    assert((num_properties+1) != 0);
     MAPI_Attr** attrs = CHECKED_XMALLOC (MAPI_Attr*, (num_properties + 1));
 
     idx += 4;
 
     if (!attrs) return NULL;
@@ -210,10 +211,11 @@ mapi_attr_read (size_t len, unsigned char *buf)
 		    CHECKINT32(idx, len); a->names[i].len = GETINT32(buf+idx); idx += 4;
 
 		    /* read the data into a buffer */
 		    a->names[i].data 
 			= CHECKED_XMALLOC(unsigned char, a->names[i].len);
+		    assert((idx+(a->names[i].len*2)) <= len);
 		    for (j = 0; j < (a->names[i].len >> 1); j++)
 			a->names[i].data[j] = (buf+idx)[j*2];
 
 		    /* But what are we going to do with it? */
 		    
@@ -306,12 +308,15 @@ mapi_attr_read (size_t len, unsigned char *buf)
 	    case szMAPI_UNICODE_STRING:
 	    case szMAPI_OBJECT:
 	    case szMAPI_BINARY:
 		CHECKINT32(idx, len); v->len = GETINT32(buf+idx); idx += 4;
 
+		assert(v->len + idx <= len);
+
 		if (a->type == szMAPI_UNICODE_STRING)
 		{
+		    assert(v->len != 0);
 		    v->data.buf = (unsigned char*)unicode_to_utf8(v->len, buf+idx);
 		}
 		else
 		{
 		    v->data.buf = CHECKED_XMALLOC(unsigned char, v->len);

Fixed code:     assert((num_properties+1) != 0);
		    assert((idx+(a->names[i].len*2)) <= len);
		assert(v->len + idx <= len);

		    assert(v->len != 0);
CVE-2022-21647: Deserialization of Untrusted Data (CWE-502)
value: CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the `old()` function and form_helper nor `RedirectResponse::withInput()` and `redirect()->withInput()`.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2022-01-04T20:15Z
Repository: https://github.com/codeigniter4/CodeIgniter4
Language: Unknown
Commit date: 2022-01-03 18:51:05 -0500
Commit message: Merge pull request from GHSA-w6jr-wj64-mc9x

fix: Deserialization of Untrusted Data in old()
CVE-2022-21715: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-01-24T20:15Z
Repository: https://github.com/codeigniter4/CodeIgniter4
Language: Unknown
Commit date: 2022-01-24 12:12:01 -0500
Commit message: Merge pull request from GHSA-7528-7jg5-6g62

Hotfix 4.1.8
CVE-2022-23556: Insufficient Verification of Data Authenticity (CWE-345)
value: CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.

CWE description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CVSS v3 base score: 7.5
Published: 2022-12-22T19:15Z
Repository: https://github.com/codeigniter4/CodeIgniter4
Language: Unknown
Commit date: 2022-12-21 21:32:22 -0500
Commit message: Merge pull request from GHSA-ghw3-5qvm-3mqc

fix: proxyIPs
CVE-2022-24711: Improper Input Validation (CWE-20)
value: CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2022-02-28T16:15Z
Repository: https://github.com/codeigniter4/CodeIgniter4
Language: Unknown
Commit date: 2022-02-25 19:49:22 -0500
Commit message: Merge pull request from GHSA-xjp4-6w75-qrj7

Hotfix 4.1.9
CVE-2022-46170: Improper Authentication (CWE-287)
value: CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2)  a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 9.8
Published: 2022-12-22T19:15Z
Repository: https://github.com/codeigniter4/CodeIgniter4
Language: Unknown
Commit date: 2022-12-21 21:36:17 -0500
Commit message: Merge pull request from GHSA-6cq5-8cj7-g558

Fix session handlers bug
CVE-2023-46240: Generation of Error Message Containing Sensitive Information (CWE-209)
value: CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 7.5
Published: 2023-10-31T16:15Z
Repository: https://github.com/codeigniter4/CodeIgniter4
Language: Unknown
Commit date: 2023-10-27 06:24:46 +0900
Commit message: Merge pull request from GHSA-hwxf-qxj7-7rfj

fix: detailed error report is displayed in production environment
CVE-2024-29904: Insufficient Information (NVD-CWE-noinfo)
value: CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later. 

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-03-29T16:15Z
Repository: https://github.com/codeigniter4/CodeIgniter4
Language: Unknown
Commit date: 2024-03-29 11:34:46 +0900
Commit message: Merge pull request from GHSA-39fp-mqmm-gxj6

fix: Language, Router, and Filters
CVE-2013-4879: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in core/inc/bigtree/cms.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Published: 2013-08-14T13:49Z
Repository: https://github.com/bigtreecms/BigTree-CMS
Language: PHP
Files changed: core/inc/bigtree/cms.php
Commit date: 2013-07-03 16:12:11 -0400
Commit message: Fixed error when putting ' in a URL by accident.

Diff: diff --git a/core/inc/bigtree/cms.php b/core/inc/bigtree/cms.php
index ff5867f5..66d34d7b 100755
--- a/core/inc/bigtree/cms.php
+++ b/core/inc/bigtree/cms.php
@@ -125,11 +125,11 @@
 		
 		function checkOldRoutes($path) {
 			$found = false;
 			$x = count($path);
 			while ($x) {
-				$f = sqlfetch(sqlquery("SELECT * FROM bigtree_route_history WHERE old_route = '".implode("/",array_slice($path,0,$x))."'"));
+				$f = sqlfetch(sqlquery("SELECT * FROM bigtree_route_history WHERE old_route = '".sqlescape(implode("/",array_slice($path,0,$x)))."'"));
 				if ($f) {
 					$old = $f["old_route"];
 					$new = $f["new_route"];
 					$found = true;
 					break;

Vulnerable code: 				$f = sqlfetch(sqlquery("SELECT * FROM bigtree_route_history WHERE old_route = '".implode("/",array_slice($path,0,$x))."'"));
Fixed code: 				$f = sqlfetch(sqlquery("SELECT * FROM bigtree_route_history WHERE old_route = '".sqlescape(implode("/",array_slice($path,0,$x)))."'"));
CVE-2013-4880: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-08-14T13:50Z
Repository: https://github.com/bigtreecms/BigTree-CMS
Language: PHP
Files changed: core/admin/modules/developer/modules/views/add.php
Commit date: 2013-07-17 11:22:13 -0400
Commit message: Fixed a potential cross-site scripting issue on the module view add page.
Thanks to High-Tech Bridge Security Research Lab for finding this and the Cross-Site Request Forgery issues.

Diff: diff --git a/core/admin/modules/developer/modules/views/add.php b/core/admin/modules/developer/modules/views/add.php
index 6437dbcc..a3dc8253 100755
--- a/core/admin/modules/developer/modules/views/add.php
+++ b/core/admin/modules/developer/modules/views/add.php
@@ -1,7 +1,7 @@
 <?
-	$id = $_GET["module"];
+	$id = htmlspecialchars($_GET["module"]);
 	$table = isset($_GET["table"]) ? $_GET["table"] : "";
 	$title = isset($_GET["title"]) ? htmlspecialchars($_GET["title"]) : "";
 	
 	$module = $admin->getModule($id);
 	$landing_exists = $admin->doesModuleLandingActionExist($id);

Vulnerable code: 	$id = $_GET["module"];
Fixed code: 	$id = htmlspecialchars($_GET["module"]);
CVE-2016-10223: Improper Access Control (CWE-284)
value: An issue was discovered in BigTree CMS before 4.2.15. The vulnerability exists due to insufficient filtration of user-supplied data in the "id" HTTP GET parameter passed to the "core/admin/adjax/dashboard/check-module-integrity.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 5.4
Published: 2017-02-14T06:59Z
Repository: https://github.com/bigtreecms/BigTree-CMS
Language: PHP
Files changed: core/admin/ajax/dashboard/check-module-integrity.php
Commit date: 2016-12-05 15:35:15 -0500
Commit message: Fixing potential XSS attack vector. Thanks to Haojun Hou in ADLab of Venustech.

Diff: diff --git a/core/admin/ajax/dashboard/check-module-integrity.php b/core/admin/ajax/dashboard/check-module-integrity.php
index 637856f89..cf29b95f7 100644
--- a/core/admin/ajax/dashboard/check-module-integrity.php
+++ b/core/admin/ajax/dashboard/check-module-integrity.php
@@ -46,11 +46,11 @@
 		foreach ($error_types as $type => $errors) {
 			foreach ($errors as $error) {
 ?>
 <li>
 	<section class="integrity_errors">
-		<a href="<?=ADMIN_ROOT.$module["route"]."/".$action["route"]."/".$_GET["id"]?>/" target="_blank">Edit</a>
+		<a href="<?=ADMIN_ROOT.$module["route"]."/".$action["route"]."/".htmlspecialchars($_GET["id"])?>/" target="_blank">Edit</a>
 		<span class="icon_small icon_small_warning"></span>
 		<p>Broken <?=(($type == "img") ? "Image" : "Link")?>: <?=$error?> in field &ldquo;<?=$form["fields"][$field]["title"]?>&rdquo;</p>
 	</section>
 </li>
 <?

Vulnerable code: 		<a href="<?=ADMIN_ROOT.$module["route"]."/".$action["route"]."/".$_GET["id"]?>/" target="_blank">Edit</a>
Fixed code: 		<a href="<?=ADMIN_ROOT.$module["route"]."/".$action["route"]."/".htmlspecialchars($_GET["id"])?>/" target="_blank">Edit</a>
CVE-2017-7695: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2017-04-11T23:59Z
Repository: https://github.com/bigtreecms/BigTree-CMS
Language: PHP
Files changed: core/inc/bigtree/apis/storage.php
Commit date: 2017-04-07 15:11:03 -0400
Commit message: Fixing empty space at the end of a file name allowing dangerous files to be uploaded.
Thank you to math1as from l-team for the disclosure and fix.

https://github.com/bigtreecms/BigTree-CMS/issues/276

Diff: diff --git a/core/inc/bigtree/apis/storage.php b/core/inc/bigtree/apis/storage.php
index e28ae5477..0c867f8c1 100755
--- a/core/inc/bigtree/apis/storage.php
+++ b/core/inc/bigtree/apis/storage.php
@@ -6,11 +6,11 @@
 
 	class BigTreeStorage {
 
 		var $AutoJPEG = false;
 		var $DisabledFileError = false;
-		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)$/i';
+		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)/i';
 		var $Service = "";
 		var $Cloud = false;
 		var $Settings;
 
 		/*

Vulnerable code: 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)$/i';
Fixed code: 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)/i';
CVE-2017-9364: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Unrestricted File Upload exists in BigTree CMS through 4.2.18: if an attacker uploads an 'xxx.pht' or 'xxx.phtml' file, they could bypass a safety check and execute any code.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2017-06-02T05:29Z
Repository: https://github.com/bigtreecms/BigTree-CMS
Language: PHP
Files changed: core/inc/bigtree/apis/storage.php
Commit date: 2017-05-25 16:28:42 -0400
Commit message: Disabling phtml/pht files from being uploaded.
https://github.com/bigtreecms/BigTree-CMS/issues/280

Diff: diff --git a/core/inc/bigtree/apis/storage.php b/core/inc/bigtree/apis/storage.php
index 0c867f8c1..7dda69252 100755
--- a/core/inc/bigtree/apis/storage.php
+++ b/core/inc/bigtree/apis/storage.php
@@ -6,11 +6,11 @@
 
 	class BigTreeStorage {
 
 		var $AutoJPEG = false;
 		var $DisabledFileError = false;
-		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)/i';
+		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht)/i';
 		var $Service = "";
 		var $Cloud = false;
 		var $Settings;
 
 		/*

Vulnerable code: 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)/i';
Fixed code: 		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx|phtml|pht)/i';
CVE-2017-9378: Incorrect Authorization (CWE-863)
value: BigTree CMS through 4.2.18 does not prevent a user from deleting their own account. This could have security relevance because deletion was supposed to be an admin-only action, and the admin may have other tasks (such as data backups) to complete before a user is deleted.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 6.5
Published: 2017-06-02T15:29Z
Repository: https://github.com/bigtreecms/BigTree-CMS
Language: PHP
Files changed: core/inc/bigtree/admin.php
Commit date: 2017-05-25 16:53:05 -0400
Commit message: Fixed a user potentially being able to delete themselves if they really really wanted to.
https://github.com/bigtreecms/BigTree-CMS/issues/282

Diff: diff --git a/core/inc/bigtree/admin.php b/core/inc/bigtree/admin.php
index 6c63ccb84..f2be82889 100755
--- a/core/inc/bigtree/admin.php
+++ b/core/inc/bigtree/admin.php
@@ -2301,11 +2301,12 @@
 
 		function deleteUser($id) {
 			$id = sqlescape($id);
 			// If this person has higher access levels than the person trying to update them, fail.
 			$current = static::getUser($id);
-			if ($current["level"] > $this->Level) {
+
+			if ($current["level"] > $this->Level || $id == $this->ID) {
 				return false;
 			}
 
 			sqlquery("DELETE FROM bigtree_users WHERE id = '$id'");
 			$this->track("bigtree_users",$id,"deleted");

Vulnerable code: 			if ($current["level"] > $this->Level) {
Fixed code: 
			if ($current["level"] > $this->Level || $id == $this->ID) {