Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2019-8293: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2019-12-23T22:15Z
Repository: https://github.com/abcprintf/upload-image-with-ajax
Language: PHP
Files changed: upload.php
Commit date: 2019-12-19 05:16:03 +0000
Commit message: update #Arbitrary file upload vulnerability

Diff: diff --git a/upload.php b/upload.php
index 17c4ae8..6f2680b 100644
--- a/upload.php
+++ b/upload.php
@@ -7,29 +7,33 @@
         $ready = false;
         if((($imageType == "image/jpeg") || ($imageType == "image/jpg") || ($imageType == "image/png"))&&in_array($fileExt, $validext)){
             $ready = true;
         }else{
             echo "was not an image<br>";
+            exit();
         }
 
         if($_FILES["fileUpload"]["size"] < 1000000){
             $ready = true;
             echo "file size is ".$_FILES['fileUpload']["size"]."<br>";
         }else{
             echo "file was TOO BIG!";
+            exit();
         }
 
         if($_FILES["fileUpload"]["error"]){
             echo "looks like there was an error".$_FILES['fileUpload']["error"]."<br>";
             $ready = false;
+            exit();
         }
 
         $targetPath = "images/".$imageFile;
         $sourcePath = $_FILES["fileUpload"]["tmp_name"];
         if(file_exists("images/".$imageFile)){
             echo "File already there <br>";
             $ready = false;
+            exit();
         }
 
         if($ready == true){
             move_uploaded_file($sourcePath,$targetPath);
             echo "upload successful!";

Fixed code:             exit();
            exit();
            exit();
            exit();
CVE-2015-5685: Improper Input Validation (CWE-20)
value: The lazy_bdecode function in BitTorrent DHT bootstrap server (bootstrap-dht ) allows remote attackers to execute arbitrary code via a crafted packet, related to "improper indexing."
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2015-08-13T14:59Z
Repository: https://github.com/bittorrent/bootstrap-dht
Language: C++
Files changed: lazy_bdecode.cpp
Commit date: 2015-06-29 14:45:09 -0700
Commit message: Check for out-of-bounds bencoded lengths before advancing buffer pointer

Diff: diff --git a/lazy_bdecode.cpp b/lazy_bdecode.cpp
index 0f7b292..fe6cb67 100644
--- a/lazy_bdecode.cpp
+++ b/lazy_bdecode.cpp
@@ -148,11 +148,13 @@ namespace libtorrent
 					bdecode_errors::error_code_enum e = bdecode_errors::no_error;
 					start = parse_int(start, end, ':', len, e);
 					if (e)
 						TORRENT_FAIL_BDECODE(e);
 
-					if (start + len + 1 > end)
+					// remaining buffer size excluding ':'
+					const ptrdiff_t buff_size = end - start - 1;
+					if (len > buff_size)
 						TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof);
 
 					if (len < 0)
 						TORRENT_FAIL_BDECODE(bdecode_errors::overflow);
 
@@ -214,16 +216,20 @@ namespace libtorrent
 					boost::int64_t len = t - '0';
 					bdecode_errors::error_code_enum e = bdecode_errors::no_error;
 					start = parse_int(start, end, ':', len, e);
 					if (e)
 						TORRENT_FAIL_BDECODE(e);
-					if (start + len + 1 > end)
+
+					// remaining buffer size excluding ':'
+					const ptrdiff_t buff_size = end - start - 1;
+					if (len > buff_size)
 						TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof);
 					if (len < 0)
 						TORRENT_FAIL_BDECODE(bdecode_errors::overflow);
 
 					++start;
+					if (start == end) TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof);
 					top->construct_string(start, int(len));
 					stack.pop_back();
 					start += len;
 					continue;
 				}

Vulnerable code: 					if (start + len + 1 > end)
					if (start + len + 1 > end)
Fixed code: 					// remaining buffer size excluding ':'
					const ptrdiff_t buff_size = end - start - 1;
					if (len > buff_size)

					// remaining buffer size excluding ':'
					const ptrdiff_t buff_size = end - start - 1;
					if (len > buff_size)
					if (start == end) TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof);
CVE-2021-43831: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access any files on the host computer if they know the file names or file paths. This is limited only by the host operating system. Paths are opened in read only mode. The problem has been patched in gradio 2.5.0.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.7
Published: 2021-12-15T20:15Z
Repository: https://github.com/gradio-app/gradio
Language: Python
Files changed: gradio/networking.py
Commit date: 2021-12-14 21:01:55 +0000
Commit message: secure path hotfix

Diff: diff --git a/gradio/networking.py b/gradio/networking.py
index 0a972816..18017249 100644
--- a/gradio/networking.py
+++ b/gradio/networking.py
@@ -375,19 +375,18 @@ def interpret():
 
 
 @app.route("/file/<path:path>", methods=["GET"])
 @login_check
 def file(path):
-    path = secure_filename(path)
     if app.interface.encrypt and isinstance(app.interface.examples, str) and path.startswith(app.interface.examples):
-        with open(os.path.join(app.cwd, path), "rb") as encrypted_file:
+        with open(safe_join(app.cwd, path), "rb") as encrypted_file:
             encrypted_data = encrypted_file.read()
         file_data = encryptor.decrypt(
             app.interface.encryption_key, encrypted_data)
         return send_file(io.BytesIO(file_data), attachment_filename=os.path.basename(path))
     else:
-        return send_file(os.path.join(app.cwd, path))
+        return send_file(safe_join(app.cwd, path))
 
 
 @app.route("/api/queue/push/", methods=["POST"])
 @login_check
 def queue_push():

Vulnerable code:     path = secure_filename(path)
        with open(os.path.join(app.cwd, path), "rb") as encrypted_file:
        return send_file(os.path.join(app.cwd, path))
Fixed code:         with open(safe_join(app.cwd, path), "rb") as encrypted_file:
        return send_file(safe_join(app.cwd, path))
CVE-2022-24770: Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
value: `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer. The problem has been patched as of `2.8.11`, which escapes the saved csv with single quotes. As a workaround, avoid opening csv files generated by `gradio` with Excel or similar spreadsheet programs.
CWE description: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CVSS v3 base score: 8.8
Published: 2022-03-17T21:15Z
Repository: https://github.com/gradio-app/gradio
Language: Unknown
Commit date: 2022-03-14 15:46:37 -0500
Commit message: Merge pull request #817 from gradio-app/csv-sec

Sanitize flagging inputs before writing to csv
CVE-2023-51449: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2023-12-22T21:15Z
Repository: https://github.com/gradio-app/gradio
Language: Python
Files changed: .changeset/rich-dragons-clap.md, gradio/routes.py
Commit date: 2023-12-14 14:10:24 -0800
Commit message: Fix SSRF vulnerability on `/file=` route (#6794)

* ssrf

* add changeset

* awaits

* checkout

---------

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>
Diff: diff --git a/.changeset/rich-dragons-clap.md b/.changeset/rich-dragons-clap.md
new file mode 100644
index 000000000..248203032
--- /dev/null
+++ b/.changeset/rich-dragons-clap.md
@@ -0,0 +1,5 @@
+---
+"gradio": minor
+---
+
+feat:Fix SSRF vulnerability on `/file=` route
diff --git a/gradio/routes.py b/gradio/routes.py
index 314e5d5be..d43616bca 100644
--- a/gradio/routes.py
+++ b/gradio/routes.py
@@ -431,11 +431,11 @@ class App(FastAPI):
 
         @app.head("/file={path_or_url:path}", dependencies=[Depends(login_check)])
         @app.get("/file={path_or_url:path}", dependencies=[Depends(login_check)])
         async def file(path_or_url: str, request: fastapi.Request):
             blocks = app.get_blocks()
-            if utils.validate_url(path_or_url):
+            if client_utils.is_http_url_like(path_or_url):
                 return RedirectResponse(
                     url=path_or_url, status_code=status.HTTP_302_FOUND
                 )
             abs_path = utils.abspath(path_or_url)
 

Vulnerable code:             if utils.validate_url(path_or_url):
Fixed code: ---
"gradio": minor
---

feat:Fix SSRF vulnerability on `/file=` route
            if client_utils.is_http_url_like(path_or_url):
CVE-2023-6572: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: Command Injection in GitHub repository gradio-app/gradio prior to main.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVSS v3 base score: 8.1
Published: 2023-12-14T14:15Z
Repository: https://github.com/gradio-app/gradio
Language: YAML
Files changed: .github/workflows/generate-changeset.yml
Commit date: 2023-11-06 16:36:34 +0000
Commit message: remove echo (#6305)


Diff: diff --git a/.github/workflows/generate-changeset.yml b/.github/workflows/generate-changeset.yml
index 617c56558..50c4af6c6 100644
--- a/.github/workflows/generate-changeset.yml
+++ b/.github/workflows/generate-changeset.yml
@@ -20,12 +20,10 @@ jobs:
       found_pr: ${{ steps.pr_details.outputs.found_pr }}
       pr_number: ${{ steps.pr_details.outputs.pr_number }}
       source_repo: ${{ steps.pr_details.outputs.source_repo }}
       source_branch: ${{ steps.pr_details.outputs.source_branch }}
     steps:
-    - name: echo concurrency group
-      run: echo ${{ github.event.workflow_run.head_repository.full_name }}::${{ github.event.workflow_run.head_branch }}
     - name: get pr details
       id: pr_details
       uses: gradio-app/github/actions/find-pr@main
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}

Vulnerable code:     - name: echo concurrency group
      run: echo ${{ github.event.workflow_run.head_repository.full_name }}::${{ github.event.workflow_run.head_branch }}
CVE-2024-4253: Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
value: A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secrets exfiltration. The issue affects versions up to and including '@gradio/video@0.6.12'. The flaw is present in the workflow's handling of GitHub context information, where it echoes the full name of the head repository, the head branch, and the workflow reference without adequate sanitization. This could potentially lead to the exfiltration of sensitive secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN', and 'CHROMATIC_PROJECT_TOKEN'.
CWE description: The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Published: 2024-06-04T08:15Z
Repository: https://github.com/gradio-app/gradio
Language: YAML
Files changed: .github/workflows/test-functional.yml
Commit date: 2024-05-01 14:41:27 +0000
Commit message: Update test-functional.yml - Fix vulnerability code injection (#8145)

* Update test-functional.yml

* Update test-functional.yml

* tweaks

---------

Co-authored-by: pngwn <hello@pngwn.io>
Diff: diff --git a/.github/workflows/test-functional.yml b/.github/workflows/test-functional.yml
index 3d20f26ef6..7afb151cc8 100644
--- a/.github/workflows/test-functional.yml
+++ b/.github/workflows/test-functional.yml
@@ -30,13 +30,10 @@ jobs:
       - uses: "gradio-app/gradio/.github/actions/changes@main"
         id: changes
         with:
           type: "functional"
           token: ${{ secrets.GITHUB_TOKEN }}
-      - name: echo github context
-        if: always()
-        run: echo "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"
 
   test-functional:
     name: "test-functional"
     needs: changes
     if: needs.changes.outputs.should_run == 'true'

Vulnerable code:       - name: echo github context
        if: always()
        run: echo "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"
CVE-2018-1000201: Untrusted Search Path (CWE-426)
value: ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
CWE description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CVSS v3 base score: 7.8
Published: 2018-06-22T18:29Z
Repository: https://github.com/ffi/ffi
Language: Ruby
Files changed: lib/ffi/library.rb
Commit date: 2018-06-01 22:18:25 +0200
Commit message: Don't treat Symbol args different to Strings in ffi_lib

Symbols were sent directly to FFI::DynamicLibrary.open in the first
attempt, resulting in a TypeError, so that only the mangled library
name was actually loaded.

This moves conversion to String to the front, so that subsequent
calls can assume Strings only.

Diff: diff --git a/lib/ffi/library.rb b/lib/ffi/library.rb
index adfa106..200ce7a 100644
--- a/lib/ffi/library.rb
+++ b/lib/ffi/library.rb
@@ -41,11 +41,10 @@ module FFI
   #  # Windows
   #  FFI.map_library_name 'c'     # -> "msvcrt.dll"
   #  FFI.map_library_name 'jpeg'  # -> "jpeg.dll"
   def self.map_library_name(lib)
     # Mangle the library name to reflect the native library naming conventions
-    lib = lib.to_s unless lib.kind_of?(String)
     lib = Library::LIBC if lib == 'c'
 
     if lib && File.basename(lib) == lib
       lib = Platform::LIBPREFIX + lib unless lib =~ /^#{Platform::LIBPREFIX}/
       r = Platform::IS_GNU ? "\\.so($|\\.[1234567890]+)" : "\\.#{Platform::LIBSUFFIX}$"
@@ -101,11 +100,11 @@ module FFI
 
         if name == FFI::CURRENT_PROCESS
           FFI::DynamicLibrary.open(nil, FFI::DynamicLibrary::RTLD_LAZY | FFI::DynamicLibrary::RTLD_LOCAL)
 
         else
-          libnames = (name.is_a?(::Array) ? name : [ name ]).map { |n| [ n, FFI.map_library_name(n) ].uniq }.flatten.compact
+          libnames = (name.is_a?(::Array) ? name : [ name ]).map(&:to_s).map { |n| [ n, FFI.map_library_name(n) ].uniq }.flatten.compact
           lib = nil
           errors = {}
 
           libnames.each do |libname|
             begin
@@ -124,11 +123,10 @@ module FFI
 
               if ldscript
                 retry
               else
                 # TODO better library lookup logic
-                libname = libname.to_s
                 unless libname.start_with?("/")
                   path = ['/usr/lib/','/usr/local/lib/'].find do |pth|
                     File.exist?(pth + libname)
                   end
                   if path

Vulnerable code:     lib = lib.to_s unless lib.kind_of?(String)
          libnames = (name.is_a?(::Array) ? name : [ name ]).map { |n| [ n, FFI.map_library_name(n) ].uniq }.flatten.compact
                libname = libname.to_s
Fixed code:           libnames = (name.is_a?(::Array) ? name : [ name ]).map(&:to_s).map { |n| [ n, FFI.map_library_name(n) ].uniq }.flatten.compact
CVE-2018-1000201: Untrusted Search Path (CWE-426)
value: ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
CWE description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CVSS v3 base score: 7.8
Published: 2018-06-22T18:29Z
Repository: https://github.com/ffi/ffi
Language: Ruby
Files changed: lib/ffi/library.rb
Commit date: 2018-06-01 22:31:40 +0200
Commit message: Don't search in hardcoded paths on Windows

Native Windows apps don't use "/usr" path to store system dlls.
It's even more harm than good to search through these directories,
since they are used in Cygwin and it can lead to accidentaly loading
Cygwin DLLs into native Windows apps.

Hardcoded paths are disabled for MINGW and MSWIN environments only.
They are still present on Cygwin and MSYS2, because these POSIX-API
based environments don't use LoadLibrary() but dl_open() to load DLLs.

Diff: diff --git a/lib/ffi/library.rb b/lib/ffi/library.rb
index 200ce7a9..f14bcad5 100644
--- a/lib/ffi/library.rb
+++ b/lib/ffi/library.rb
@@ -123,11 +123,11 @@ module FFI
 
               if ldscript
                 retry
               else
                 # TODO better library lookup logic
-                unless libname.start_with?("/")
+                unless libname.start_with?("/") || FFI::Platform.windows?
                   path = ['/usr/lib/','/usr/local/lib/'].find do |pth|
                     File.exist?(pth + libname)
                   end
                   if path
                     libname = path + libname

Vulnerable code:                 unless libname.start_with?("/")
Fixed code:                 unless libname.start_with?("/") || FFI::Platform.windows?
CVE-2024-40129: Insufficient Information (NVD-CWE-noinfo)
value: Open5GS v2.6.4 is vulnerable to Buffer Overflow. via /lib/pfcp/context.c.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-16T19:15Z
Repository: https://github.com/open5gs/open5gs
Language: C
Files changed: lib/pfcp/context.c
Commit date: 2023-09-06 07:14:51 +0900
Commit message: [PFCP] Fixed Possible heap buffer overflow (#2585)

After examining the call stack and reading the source code, I found that
in /lib/core/ogs-pool.h line 152: (pool)->array[i] = i+1;
then in lib/pfcp/context.c line 78: pdr_random_to_index[ogs_pfcp_pdr_teid_pool.array[i]] = i;
ogs_pfcp_pdr_teid_pool.array[i] may exceed the size of pdr_random_to_index, leading to a heap-buffer-overflow.

Diff: diff --git a/lib/pfcp/context.c b/lib/pfcp/context.c
index 23c3531e02..1ac9be65e7 100644
--- a/lib/pfcp/context.c
+++ b/lib/pfcp/context.c
@@ -70,11 +70,11 @@ void ogs_pfcp_context_init(void)
             ogs_app()->pool.sess * OGS_MAX_NUM_OF_PDR);
     ogs_pool_init(&ogs_pfcp_pdr_teid_pool, ogs_pfcp_pdr_pool.size);
     ogs_pool_random_id_generate(&ogs_pfcp_pdr_teid_pool);
 
     pdr_random_to_index = ogs_calloc(
-            sizeof(ogs_pool_id_t), ogs_pfcp_pdr_pool.size);
+            sizeof(ogs_pool_id_t), ogs_pfcp_pdr_pool.size+1);
     ogs_assert(pdr_random_to_index);
     for (i = 0; i < ogs_pfcp_pdr_pool.size; i++)
         pdr_random_to_index[ogs_pfcp_pdr_teid_pool.array[i]] = i;
 
     ogs_pool_init(&ogs_pfcp_rule_pool,

Vulnerable code:             sizeof(ogs_pool_id_t), ogs_pfcp_pdr_pool.size);
Fixed code:             sizeof(ogs_pool_id_t), ogs_pfcp_pdr_pool.size+1);
CVE-2017-1000457: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in Help.aspx in mojoPortal version 2.5.0.0 allows remote attackers to inject arbitrary web script or HTML via the helpkey parameter. Exploitation requires authenticated reflected cross-site scripting for user accounts assigned either the "Administrators" or "Content Administrators" role.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2018-01-02T18:29Z
Repository: https://github.com/i7MEDIA/mojoportal
Language: C#
Files changed: Web/Help.aspx.cs
Commit date: 2017-09-06 11:31:51 -0500
Commit message: Fix possible XSS bug in help dialog


Diff: diff --git a/Web/Help.aspx.cs b/Web/Help.aspx.cs
index b912b791..5df0a9e8 100644
--- a/Web/Help.aspx.cs
+++ b/Web/Help.aspx.cs
@@ -1,10 +1,11 @@
-using System;
-using System.Web.UI;
 using mojoPortal.Business.WebHelpers;
 using mojoPortal.Web.Framework;
 using Resources;
+using System;
+using System.Web;
+using System.Web.UI;
 
 namespace mojoPortal.Web.UI.Pages
 {
 	public partial class Help : Page
 	{
@@ -59,9 +60,9 @@ namespace mojoPortal.Web.UI.Pages
 				helpText = WebUser.IsAdminOrContentAdmin ?
 					String.Format(Resource.HelpNoHelpAvailableAdminUser, helpKey) :
 					Resource.HelpNoHelpAvailable;
 			}
 
-			litHelp.Text = helpText;
+			litHelp.Text = HttpUtility.HtmlDecode(SecurityHelper.RemoveMarkup(helpText));
 		}
 	}
-}
+}
\ No newline at end of file

Vulnerable code: using System;
using System.Web.UI;
			litHelp.Text = helpText;
}
Fixed code: using System;
using System.Web;
using System.Web.UI;
			litHelp.Text = HttpUtility.HtmlDecode(SecurityHelper.RemoveMarkup(helpText));
}
CVE-2020-26255: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.1
Published: 2020-12-08T15:15Z
Repository: https://github.com/getkirby/kirby
Language: Unknown
Commit date: 2020-12-01 13:05:18 +0100
Commit message: Merge pull request #2962 from getkirby/fix/upload-validation

Upload validation
CVE-2024-27087: Insufficient Information (NVD-CWE-noinfo)
value: Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a "Custom" link type for advanced use cases that don't fit any of the pre-defined link formats.  As the "Custom" link type is meant to be flexible, it also allows the javascript: URL scheme. In some use cases this can be intended, but it can also be misused by attackers to execute arbitrary JavaScript code when a user or visitor clicks on a link that is generated from the contents of the link field. This vulnerability is patched in 4.1.1.


CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-26T17:15Z
Repository: https://github.com/getkirby/kirby
Language: PHP
Files changed: config/fields/link.php, tests/Form/Fields/LinkFieldTest.php
Commit date: 2024-02-25 18:44:52 +0100
Commit message: Link field: Don’t allow custom type by default

https://github.com/getkirby/kirby/security/advisories/GHSA-63h4-w25c-3qv4

Diff: diff --git a/config/fields/link.php b/config/fields/link.php
index b86cf9fa95..885eb87626 100644
--- a/config/fields/link.php
+++ b/config/fields/link.php
@@ -20,12 +20,11 @@ return [
 				'url',
 				'page',
 				'file',
 				'email',
 				'tel',
-				'anchor',
-				'custom'
+				'anchor'
 			];
 		},
 		'value' => function (string|null $value = null) {
 			return $value ?? '';
 		}
diff --git a/tests/Form/Fields/LinkFieldTest.php b/tests/Form/Fields/LinkFieldTest.php
index 6eaaad90fb..ea99a9abe2 100644
--- a/tests/Form/Fields/LinkFieldTest.php
+++ b/tests/Form/Fields/LinkFieldTest.php
@@ -24,10 +24,9 @@ class LinkFieldTest extends TestCase
 			'url',
 			'page',
 			'file',
 			'email',
 			'tel',
-			'anchor',
-			'custom'
+			'anchor'
 		], $field->options());
 	}
 }

Vulnerable code: 				'anchor',
				'custom'
			'anchor',
			'custom'
Fixed code: 				'anchor'
			'anchor'
CVE-2024-38532: Insufficient Information (NVD-CWE-noinfo)
value: The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcp_tool reference implementation included in the repository selected the test key, regardless of its `-t` argument. This issue has been patched in commit 26a7.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-06-28T22:15Z
Repository: https://github.com/usbarmory/mxs-dcp
Language: Unknown
Commit date: 2024-06-27 10:13:57 +0200
Commit message: Merge pull request #7 from dress-code-IT-GmbH/master

load empty key to activate DCP internal key
CVE-2022-21129: Other (NVD-CWE-Other)
value: Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.**Note:** In order to exploit this vulnerability appium-running 0.1.3  has to be installed as one of nemo-appium dependencies. 
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2023-01-31T05:15Z
Repository: https://github.com/paypal/nemo-appium
Language: JavaScript
Files changed: index.js, package.json, test/index.js
Commit date: 2022-12-29 12:01:43 -0600
Commit message: prevent OS commands from being injected

Diff: diff --git a/index.js b/index.js
index bdd06b6..30116f0 100644
--- a/index.js
+++ b/index.js
@@ -6,10 +6,15 @@ var debug = require('debug');
 var log = debug('nemo-appium:log');
 var error = debug('nemo-appium:error');
 
 
 module.exports.setup = function (apath, nemo, cb) {
+    // validate apath since we are going to execute it
+    // should end in appium, and contain no spaces
+    if (apath.indexOf('appium') !== apath.length - 6 || apath.indexOf(' ') > -1) {
+        return cb(new Error('Invalid path to appium executable'))
+    }
     var once = function () {
         cb.apply(null, arguments);
         once = function () {
             error('once called more than once');
         };
diff --git a/package.json b/package.json
index 863863b..ef4599d 100644
--- a/package.json
+++ b/package.json
@@ -21,9 +21,9 @@
   "bugs": {
     "url": "https://github.com/paypal/nemo-appium/issues"
   },
   "homepage": "https://github.com/paypal/nemo-appium#readme",
   "dependencies": {
-    "appium-running": "^0.1.3",
+    "appium-running": "0.1.3",
     "debug": "^2.2.0"
   }
 }
diff --git a/test/index.js b/test/index.js
index 2ba5110..da6b3dc 100644
--- a/test/index.js
+++ b/test/index.js
@@ -1,12 +1,13 @@
 var naPlugin = require('../index');
 var nemo = {};
 ///Users/medelman/.nvm/current/bin/appium
-var appiumPath = process.env.APPIUM_PATH;
+var appiumPath ='touch HACKED && ~/bin/appium';
 
 naPlugin.setup(appiumPath, nemo, function (err, out) {
     if (err) {
+        console.log('You want to see this error. It means the setup function is validating the appium path for potential OS commands');
         return console.error(err);
     }
     setTimeout(function () {
         nemo.appium && nemo.appium.process && nemo.appium.process.kill();
         console.log('things seem fine but somebody should write better unit tests');

Vulnerable code:     "appium-running": "^0.1.3",
var appiumPath = process.env.APPIUM_PATH;
Fixed code:     // validate apath since we are going to execute it
    // should end in appium, and contain no spaces
    if (apath.indexOf('appium') !== apath.length - 6 || apath.indexOf(' ') > -1) {
        return cb(new Error('Invalid path to appium executable'))
    }
    "appium-running": "0.1.3",
var appiumPath ='touch HACKED && ~/bin/appium';
        console.log('You want to see this error. It means the setup function is validating the appium path for potential OS commands');
CVE-2020-26279: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.1
Published: 2021-03-24T21:15Z
Repository: https://github.com/ipfs/go-ipfs
Language: Unknown
Commit date: 2020-12-08 17:12:31 -0500
Commit message: Merge pull request #7812 from ipfs/chore/update-deps

chore: update deps
CVE-2020-26283: Improper Encoding or Escaping of Output (CWE-116)
value: go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. This is fixed in version 0.8.0.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 8.8
Published: 2021-03-24T21:15Z
Repository: https://github.com/ipfs/go-ipfs
Language: Unknown
Commit date: 2021-01-14 13:00:51 -0500
Commit message: Merge pull request #7831 from ipfs/fix/escape-nonprintable-chars

Escape non-printable characters in user output
CVE-2022-4880: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability was found in stakira OpenUtau. It has been classified as critical. This affects the function VoicebankInstaller of the file OpenUtau.Core/Classic/VoicebankInstaller.cs of the component ZIP Archive Handler. The manipulation leads to path traversal. Upgrading to version 0.0.991 is able to address this issue. The identifier of the patch is 849a0a6912aac8b1c28cc32aa1132a3140caff4a. It is recommended to upgrade the affected component. The identifier VDB-217617 was assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2023-01-07T13:15Z
Repository: https://github.com/stakira/OpenUtau
Language: Unknown
Commit date: 2022-11-13 20:02:20 -0800
Commit message: Merge pull request #544 from oxygen-dioxide/zipslip

Prevent from zip slip attack / 防范zip上级文件夹攻击
CVE-2020-23915: Out-of-bounds Read (CWE-125)
value: An issue was discovered in cpp-peglib through v0.1.12. peg::resolve_escape_sequence() in peglib.h has a heap-based buffer over-read.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2021-04-21T18:15Z
Repository: https://github.com/yhirose/cpp-peglib
Language: C++
Files changed: peglib.h, test/test1.cc
Commit date: 2020-08-07 13:42:51 -0400
Commit message: Fix #122

Diff: diff --git a/peglib.h b/peglib.h
index fc949de..89f9abc 100644
--- a/peglib.h
+++ b/peglib.h
@@ -178,15 +178,15 @@ auto make_scope_exit(EF &&exit_function) -> scope_exit<EF> {
 inline size_t codepoint_length(const char *s8, size_t l) {
   if (l) {
     auto b = static_cast<uint8_t>(s8[0]);
     if ((b & 0x80) == 0) {
       return 1;
-    } else if ((b & 0xE0) == 0xC0) {
+    } else if ((b & 0xE0) == 0xC0 && l >= 2) {
       return 2;
-    } else if ((b & 0xF0) == 0xE0) {
+    } else if ((b & 0xF0) == 0xE0 && l >= 3) {
       return 3;
-    } else if ((b & 0xF8) == 0xF0) {
+    } else if ((b & 0xF8) == 0xF0 && l >= 4) {
       return 4;
     }
   }
   return 0;
 }
diff --git a/test/test1.cc b/test/test1.cc
index 32e6706..a583e81 100644
--- a/test/test1.cc
+++ b/test/test1.cc
@@ -43,10 +43,21 @@ TEST_CASE("Start rule with ignore operator test", "[general]")
 
     bool ret = parser;
     REQUIRE(ret == false);
 }
 
+TEST_CASE("Invalid UTF-8 text test", "[general]")
+{
+    std::string s = "a <- '";
+    s += static_cast<char>(0xe8); // Make invalid utf8 text...
+
+    parser parser(s.c_str());
+
+    bool ret = parser;
+    REQUIRE(ret == false);
+}
+
 TEST_CASE("Backslash escape sequence test", "[general]")
 {
     parser parser(R"(
         ROOT <- _
         _ <- '\\'

Vulnerable code:     } else if ((b & 0xE0) == 0xC0) {
    } else if ((b & 0xF0) == 0xE0) {
    } else if ((b & 0xF8) == 0xF0) {
Fixed code:     } else if ((b & 0xE0) == 0xC0 && l >= 2) {
    } else if ((b & 0xF0) == 0xE0 && l >= 3) {
    } else if ((b & 0xF8) == 0xF0 && l >= 4) {
TEST_CASE("Invalid UTF-8 text test", "[general]")
{
    std::string s = "a <- '";
    s += static_cast<char>(0xe8); // Make invalid utf8 text...

    parser parser(s.c_str());

    bool ret = parser;
    REQUIRE(ret == false);
}
CVE-2022-4953: Insufficient Information (NVD-CWE-noinfo)
value: The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.1
Published: 2023-08-14T20:15Z
Repository: https://github.com/elementor/elementor
Language: JavaScript
Files changed: assets/dev/js/frontend/utils/lightbox/lightbox.js
Commit date: 2022-01-24 09:14:53 +0200
Commit message: Tweak: Lightbox - only play a video if it has a registered provider [ED-6293] (#17527)


Diff: diff --git a/assets/dev/js/frontend/utils/lightbox/lightbox.js b/assets/dev/js/frontend/utils/lightbox/lightbox.js
index 1ff4aa1ee..f0b8e8137 100644
--- a/assets/dev/js/frontend/utils/lightbox/lightbox.js
+++ b/assets/dev/js/frontend/utils/lightbox/lightbox.js
@@ -254,16 +254,18 @@ module.exports = elementorModules.ViewModule.extend( {
 		if ( 'hosted' === options.videoType ) {
 			const videoParams = $.extend( { src: options.url, autoplay: '' }, options.videoParams );
 
 			$videoElement = $( '<video>', videoParams );
 		} else {
-			let apiProvider = elementorFrontend.utils.baseVideoLoader;
+			let apiProvider;
 
 			if ( -1 !== options.url.indexOf( 'vimeo.com' ) ) {
 				apiProvider = elementorFrontend.utils.vimeo;
 			} else if ( options.url.match( /^(?:https?:\/\/)?(?:www\.)?(?:m\.)?(?:youtu\.be\/|youtube\.com)/ ) ) {
 				apiProvider = elementorFrontend.utils.youtube;
+			} else {
+				return;
 			}
 
 			$videoElement = $( '<iframe>', { src: apiProvider.getAutoplayURL( options.url ), allowfullscreen: 1 } );
 		}
 

Vulnerable code: 			let apiProvider = elementorFrontend.utils.baseVideoLoader;
Fixed code: 			let apiProvider;
			} else {
				return;
CVE-2015-5232: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
value: Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.
CWE description: The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CVSS v3 base score: 8.1
Published: 2017-06-07T20:29Z
Repository: https://github.com/01org/opa-fm
Language: Shell
Files changed: Esm/ib/src/linux/startup/fm_config/config_diff.sh, Esm/ib/src/linux/startup/fm_config/config_generate.sh
Commit date: 2015-09-21 17:16:46 -0400
Commit message: Fix scripts that use well-known temp files.

Diff: diff --git a/Esm/ib/src/linux/startup/fm_config/config_diff.sh b/Esm/ib/src/linux/startup/fm_config/config_diff.sh
index 4e5d713..b8443f2 100755
--- a/Esm/ib/src/linux/startup/fm_config/config_diff.sh
+++ b/Esm/ib/src/linux/startup/fm_config/config_diff.sh
@@ -28,13 +28,14 @@
 # 
 # END_ICS_COPYRIGHT8   ****************************************
 
 # [ICS VERSION STRING: unknown]
 
-TEMP1=/tmp/smdiffa$$
-TEMP2=/tmp/smdiffb$$
+TEMP1=`mktemp`
+TEMP2=`mktemp`
 trap "rm -f $TEMP1 $TEMP2; exit 1" SIGHUP SIGTERM SIGINT
+trap "rm -f $TEMP1 $TEMP2" EXIT
 
 Usage()
 {
 	echo "Usage: config_diff [-f][-l] [-d 'diff_args'] file1 file2" >&2
 	echo "      -f  - filter out FM parameters which are not part of consistency check" >&2
diff --git a/Esm/ib/src/linux/startup/fm_config/config_generate.sh b/Esm/ib/src/linux/startup/fm_config/config_generate.sh
index 6c27672..c9db1f5 100755
--- a/Esm/ib/src/linux/startup/fm_config/config_generate.sh
+++ b/Esm/ib/src/linux/startup/fm_config/config_generate.sh
@@ -28,12 +28,13 @@
 # 
 # END_ICS_COPYRIGHT8   ****************************************
 
 # [ICS VERSION STRING: unknown]
 
-TEMP=/tmp/smgen$$
+TEMP=`mktemp`
 trap "rm -f $TEMP; exit 1" SIGHUP SIGTERM SIGINT
+trap "rm -f $TEMP" EXIT
 
 Usage()
 {
 	echo "Usage: config_generate [-e] dest_file" >&2
 	echo "      -e  - generate file for embedded FM, default is to generate for host FM" >&2

Vulnerable code: TEMP1=/tmp/smdiffa$$
TEMP2=/tmp/smdiffb$$
TEMP=/tmp/smgen$$
Fixed code: TEMP1=`mktemp`
TEMP2=`mktemp`
trap "rm -f $TEMP1 $TEMP2" EXIT
TEMP=`mktemp`
trap "rm -f $TEMP" EXIT
CVE-2016-10083: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in admin/plugin.php in Piwigo through 2.8.3 allows remote attackers to inject arbitrary web script or HTML via a crafted filename that is mishandled in a certain error case.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-12-30T07:59Z
Repository: https://github.com/Piwigo/Piwigo
Language: PHP
Files changed: admin/plugin.php
Commit date: 2016-12-24 19:53:49 +0100
Commit message: fixes #575, sanitize user input before display on die()

Diff: diff --git a/admin/plugin.php b/admin/plugin.php
index 68e0c50d7..16de979a5 100644
--- a/admin/plugin.php
+++ b/admin/plugin.php
@@ -61,8 +61,8 @@ if (is_file($filename))
 {
   include_once($filename);
 }
 else
 {
-  die('Missing file '.$filename);
+  die('Missing file '.htmlentities($filename));
 }
 ?>
\ No newline at end of file

Vulnerable code:   die('Missing file '.$filename);
Fixed code:   die('Missing file '.htmlentities($filename));
CVE-2016-10084: Improper Access Control (CWE-284)
value: admin/batch_manager.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the $page['tab'] variable (aka the mode parameter).
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 7.2
Published: 2016-12-30T07:59Z
Repository: https://github.com/Piwigo/Piwigo
Language: PHP
Files changed: admin/batch_manager.php
Commit date: 2016-12-19 11:33:09 +0100
Commit message: fixes #572, check $_GET['mode'] against hacking attempt

Diff: diff --git a/admin/batch_manager.php b/admin/batch_manager.php
index cbeb0ebe9..792cb1f54 100644
--- a/admin/batch_manager.php
+++ b/admin/batch_manager.php
@@ -591,10 +591,11 @@ else
 // +-----------------------------------------------------------------------+
 $manager_link = get_root_url().'admin.php?page=batch_manager&amp;mode=';
 
 if (isset($_GET['mode']))
 {
+  check_input_parameter('mode', $_GET, false, '/^(global|unit)$/');
   $page['tab'] = $_GET['mode'];
 }
 else
 {
   $page['tab'] = 'global';

Fixed code:   check_input_parameter('mode', $_GET, false, '/^(global|unit)$/');
CVE-2016-10085: Improper Access Control (CWE-284)
value: admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 7.2
Published: 2016-12-30T07:59Z
Repository: https://github.com/Piwigo/Piwigo
Language: PHP
Files changed: admin/languages.php
Commit date: 2016-12-19 11:52:28 +0100
Commit message: fixes #573, check $_GET['tab'] against hacking attempt

Diff: diff --git a/admin/languages.php b/admin/languages.php
index 0ea4c17df..936e5b253 100644
--- a/admin/languages.php
+++ b/admin/languages.php
@@ -29,13 +29,18 @@ if( !defined("PHPWG_ROOT_PATH") )
 include_once(PHPWG_ROOT_PATH.'admin/include/tabsheet.class.php');
 
 $my_base_url = get_root_url().'admin.php?page=languages';
 
 if (isset($_GET['tab']))
+{
+  check_input_parameter('tab', $_GET, false, '/^(installed|update|new)$/');
   $page['tab'] = $_GET['tab'];
+}
 else
+{
   $page['tab'] = 'installed';
+}
 
 $tabsheet = new tabsheet();
 $tabsheet->set_id('languages');
 $tabsheet->select($page['tab']);
 $tabsheet->assign();

Fixed code: {
  check_input_parameter('tab', $_GET, false, '/^(installed|update|new)$/');
}
{
}
CVE-2016-10105: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 9.8
Published: 2017-01-03T06:59Z
Repository: https://github.com/Piwigo/Piwigo
Language: PHP
Files changed: admin/plugin.php
Commit date: 2017-01-01 19:40:53 +0100
Commit message: fixes #574, new checks on plugin section in URL

Diff: diff --git a/admin/plugin.php b/admin/plugin.php
index 16de979a5..704c3ad5e 100644
--- a/admin/plugin.php
+++ b/admin/plugin.php
@@ -30,14 +30,20 @@ include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 check_status(ACCESS_ADMINISTRATOR);
 
 $sections = explode('/', $_GET['section'] );
 for ($i=0; $i<count($sections); $i++)
 {
-  if (empty($sections[$i]) or $sections[$i]=='..')
+  if (empty($sections[$i]))
   {
     unset($sections[$i]);
     $i--;
+    continue;
+  }
+
+  if ($sections[$i] == '..' or !preg_match('/^[a-zA-Z_\.-]+$/', $sections[$i]))
+  {
+    die('invalid section token ['.htmlentities($sections[$i]).']');
   }
 }
 
 if (count($sections)<2)
 {

Vulnerable code:   if (empty($sections[$i]) or $sections[$i]=='..')
Fixed code:   if (empty($sections[$i]))
    continue;
  }

  if ($sections[$i] == '..' or !preg_match('/^[a-zA-Z_\.-]+$/', $sections[$i]))
  {
    die('invalid section token ['.htmlentities($sections[$i]).']');
CVE-2016-10105: Improper Access Control (CWE-284)
value: admin/plugin.php in Piwigo through 2.8.3 doesn't validate the sections variable while using it to include files. This can cause information disclosure and code execution if it contains a .. sequence.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 9.8
Published: 2017-01-03T06:59Z
Repository: https://github.com/Piwigo/Piwigo
Language: PHP
Files changed: admin/plugin.php
Commit date: 2017-01-01 19:40:53 +0100
Commit message: fixes #574, new checks on plugin section in URL

Diff: diff --git a/admin/plugin.php b/admin/plugin.php
index 16de979a5..704c3ad5e 100644
--- a/admin/plugin.php
+++ b/admin/plugin.php
@@ -30,14 +30,20 @@ include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 check_status(ACCESS_ADMINISTRATOR);
 
 $sections = explode('/', $_GET['section'] );
 for ($i=0; $i<count($sections); $i++)
 {
-  if (empty($sections[$i]) or $sections[$i]=='..')
+  if (empty($sections[$i]))
   {
     unset($sections[$i]);
     $i--;
+    continue;
+  }
+
+  if ($sections[$i] == '..' or !preg_match('/^[a-zA-Z_\.-]+$/', $sections[$i]))
+  {
+    die('invalid section token ['.htmlentities($sections[$i]).']');
   }
 }
 
 if (count($sections)<2)
 {

Vulnerable code:   if (empty($sections[$i]) or $sections[$i]=='..')
Fixed code:   if (empty($sections[$i]))
    continue;
  }

  if ($sections[$i] == '..' or !preg_match('/^[a-zA-Z_\.-]+$/', $sections[$i]))
  {
    die('invalid section token ['.htmlentities($sections[$i]).']');