CVE-2024-25410: Insufficient Information (NVD-CWE-noinfo)
value: flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-26T16:27Z
Repository: https://github.com/flusity/flusity-CMS
Language: PHP
Files changed: core/tools/actions/update_setting.php
Commit date: 2024-02-03 15:41:41 +0200
Commit message: Update update_setting.php

Signed-off-by: Darius Jakaitis <105962203+flusity@users.noreply.github.com>
Diff: diff --git a/core/tools/actions/update_setting.php b/core/tools/actions/update_setting.php
index b69d7ba..0a973fb 100644
--- a/core/tools/actions/update_setting.php
+++ b/core/tools/actions/update_setting.php
@@ -6,65 +6,62 @@ if (session_status() !== PHP_SESSION_ACTIVE) {
 
 define('IS_ADMIN', true);
 $configurations = require $_SERVER['DOCUMENT_ROOT'] . '/security/config.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/core/functions/functions.php';
 
-require_once $_SERVER['DOCUMENT_ROOT'] . '/security/config.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/core/functions/functions.php';
 define('ROOT_PATH', $_SERVER['DOCUMENT_ROOT'] . '/');
 
 $config = $configurations['config'];
 $prefix = $configurations['prefix'];
 
- $db = getDBConnection($config);
+$db = getDBConnection($config);
 secureSession($db, $prefix);
 $language_code = getLanguageSetting($db, $prefix);
 $translations = getTranslations($db, $prefix, $language_code);
 
 $result = ['error_message' => false];
 $updateResult = ['error_message' => false];
 
-if (isset($_POST['site_title'], $_POST['meta_description'], $_POST['footer_text'], $_POST['pretty_url'], $_POST['bilingualism'], $_POST['language'],
- $_POST['posts_per_page'], $_POST['registration_enabled'], $_POST['session_lifetime'], $_POST['default_keywords'])) { 
+if (isset($_POST['site_title'], $_POST['meta_description'], $_POST['footer_text'], $_POST['pretty_url'], $_POST['bilingualism'], $_POST['language'], $_POST['posts_per_page'], $_POST['registration_enabled'], $_POST['session_lifetime'], $_POST['default_keywords'])) {
 
     $allowed_file_types = ['image/png', 'image/jpeg', 'image/gif'];
-    $target_dir = ROOT_PATH. "/uploads/";
+    $allowed_file_extensions = ['png', 'jpeg', 'jpg', 'gif']; // Pridėtas leidžiamų plėtinių sąrašas
+    $target_dir = ROOT_PATH . "/uploads/";
     $max_file_size = 100 * 1024; // Maximum file size (100KB)
     $brand_icone = null; // Initialize this variable before if condition
 
     if (isset($_FILES["brand_icone"]) && $_FILES["brand_icone"]["size"] > 0) {
         $uploaded_file = $_FILES["brand_icone"];
-        $unique_code = bin2hex(random_bytes(8));
         $filename_parts = pathinfo($uploaded_file["name"]);
-        $new_filename = $filename_parts['filename'] . '_' . $unique_code . '.' . $filename_parts['extension'];
-        $target_file = $target_dir . basename($new_filename);
-        $brand_icone = $new_filename; // Use the new filename
-  
-        if (!in_array($uploaded_file['type'], $allowed_file_types)) {
-            $_SESSION['error_message'] = t("Invalid file type.");
-           
-        } 
+        $file_extension = strtolower($filename_parts['extension']); // Paverčiama mažosiomis raidėmis, kad būtų lengviau palyginti
 
-        if ($uploaded_file['size'] > $max_file_size) {
+        if (!in_array($uploaded_file['type'], $allowed_file_types) || !in_array($file_extension, $allowed_file_extensions)) {
+            $_SESSION['error_message'] = t("Invalid file type or extension.");
+        } elseif ($uploaded_file['size'] > $max_file_size) {
             $_SESSION['error_message'] = t("File size exceeded limit.");
-           
-        } 
-
-        if (move_uploaded_file($uploaded_file["tmp_name"], $target_file)) {
-            $file_url = $_SERVER['REQUEST_SCHEME'] . "://" . $_SERVER['HTTP_HOST'] . "/uploads/" . $new_filename;
-            saveFileToDatabase($db, $prefix, $new_filename, $file_url);
-            $_SESSION['success_message'] = "File" ." ". basename($uploaded_file["name"]) . " " .t("file uploaded successfully.");
         } else {
-            $_SESSION['error_message'] = t("Error loading file.");
-         
+            $unique_code = bin2hex(random_bytes(8));
+            $new_filename = $filename_parts['filename'] . '_' . $unique_code . '.' . $file_extension;
+            $target_file = $target_dir . basename($new_filename);
+            $brand_icone = $new_filename; // Use the new filename
+
+            if (move_uploaded_file($uploaded_file["tmp_name"], $target_file)) {
+                $file_url = $_SERVER['REQUEST_SCHEME'] . "://" . $_SERVER['HTTP_HOST'] . "/uploads/" . $new_filename;
+                saveFileToDatabase($db, $prefix, $new_filename, $file_url);
+                $_SESSION['success_message'] = "File " . basename($uploaded_file["name"]) . " " . t("file uploaded successfully.");
+            } else {
+                $_SESSION['error_message'] = t("Error loading file.");
+            }
         }
     } elseif (isset($_POST['brand_icone_id']) && !empty($_POST['brand_icone_id'])) {
         // Fetch the file using its id
         $file = getFileById($db, $prefix, $_POST['brand_icone_id']);
         $brand_icone = $file['name'];
     }
 
+
     $site_title = $_POST['site_title'];
     $meta_description = $_POST['meta_description'];
     $footer_text_settings = $_POST['footer_text'];
     $pretty_url = $_POST['pretty_url']; 
     $bilingualism = $_POST['bilingualism'];
@@ -90,6 +87,6 @@ if (isset($_POST['site_title'], $_POST['meta_description'], $_POST['footer_text'
     }
  }
 
 echo json_encode($updateResult); 
 
-?>
\ No newline at end of file
+?>

Vulnerable code: require_once $_SERVER['DOCUMENT_ROOT'] . '/security/config.php';
 $db = getDBConnection($config);
if (isset($_POST['site_title'], $_POST['meta_description'], $_POST['footer_text'], $_POST['pretty_url'], $_POST['bilingualism'], $_POST['language'],
 $_POST['posts_per_page'], $_POST['registration_enabled'], $_POST['session_lifetime'], $_POST['default_keywords'])) { 
    $target_dir = ROOT_PATH. "/uploads/";
        $unique_code = bin2hex(random_bytes(8));
        $new_filename = $filename_parts['filename'] . '_' . $unique_code . '.' . $filename_parts['extension'];
        $target_file = $target_dir . basename($new_filename);
        $brand_icone = $new_filename; // Use the new filename
  
        if (!in_array($uploaded_file['type'], $allowed_file_types)) {
            $_SESSION['error_message'] = t("Invalid file type.");
           
        } 
        if ($uploaded_file['size'] > $max_file_size) {
           
        } 

        if (move_uploaded_file($uploaded_file["tmp_name"], $target_file)) {
            $file_url = $_SERVER['REQUEST_SCHEME'] . "://" . $_SERVER['HTTP_HOST'] . "/uploads/" . $new_filename;
            saveFileToDatabase($db, $prefix, $new_filename, $file_url);
            $_SESSION['success_message'] = "File" ." ". basename($uploaded_file["name"]) . " " .t("file uploaded successfully.");
            $_SESSION['error_message'] = t("Error loading file.");
         
?>
Fixed code: $db = getDBConnection($config);
if (isset($_POST['site_title'], $_POST['meta_description'], $_POST['footer_text'], $_POST['pretty_url'], $_POST['bilingualism'], $_POST['language'], $_POST['posts_per_page'], $_POST['registration_enabled'], $_POST['session_lifetime'], $_POST['default_keywords'])) {
    $allowed_file_extensions = ['png', 'jpeg', 'jpg', 'gif']; // Pridėtas leidžiamų plėtinių sąrašas
    $target_dir = ROOT_PATH . "/uploads/";
        $file_extension = strtolower($filename_parts['extension']); // Paverčiama mažosiomis raidėmis, kad būtų lengviau palyginti
        if (!in_array($uploaded_file['type'], $allowed_file_types) || !in_array($file_extension, $allowed_file_extensions)) {
            $_SESSION['error_message'] = t("Invalid file type or extension.");
        } elseif ($uploaded_file['size'] > $max_file_size) {
            $unique_code = bin2hex(random_bytes(8));
            $new_filename = $filename_parts['filename'] . '_' . $unique_code . '.' . $file_extension;
            $target_file = $target_dir . basename($new_filename);
            $brand_icone = $new_filename; // Use the new filename

            if (move_uploaded_file($uploaded_file["tmp_name"], $target_file)) {
                $file_url = $_SERVER['REQUEST_SCHEME'] . "://" . $_SERVER['HTTP_HOST'] . "/uploads/" . $new_filename;
                saveFileToDatabase($db, $prefix, $new_filename, $file_url);
                $_SESSION['success_message'] = "File " . basename($uploaded_file["name"]) . " " . t("file uploaded successfully.");
            } else {
                $_SESSION['error_message'] = t("Error loading file.");
            }

?>