CVE-2023-2665: Insecure Storage of Sensitive Information (CWE-922)
value: Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.
CWE description: The product stores sensitive information without properly limiting read or write access by unauthorized actors.
CVSS v3 base score: 7.5
Published: 2023-05-12T01:15Z
Repository: https://github.com/francoisjacquet/rosariosis
Language: PHP
Files changed: CHANGES.md, ProgramFunctions/FileUpload.fnc.php, modules/Accounting/functions.inc.php, modules/School_Setup/PortalNotes.php, modules/Student_Billing/functions.inc.php
Commit date: 2023-04-11 18:45:04 +0200
Commit message: Add microseconds to filename format to make it harder to predict

Diff: diff --git a/CHANGES.md b/CHANGES.md
index e912eaa70e..c1de5f240b 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -8,10 +8,11 @@ Changes in 11.0
 - Calculate Weighted Grade in Grades.php, InputFinalGrades.php & ProgressReports.php
 - Add Assignment Weight in StudentGrades.php & StudentAssignments.fnc.php
 - Translate "Zip" & "Zipcode" to "Zip Code" in GetStuList.fnc.php, MyReport.php, Registration.fnc.php, Schools.php & Address.inc.php
 - HTML Text input min size is 2 in Inputs.php
 - Skip School Period column if has no students scheduled for selected date in Administration.php
+- Add microseconds to filename format to make it harder to predict in FileUpload.fnc.php, Accounting/functions.php, PortalNotes.php & Student_Billing/functions.php
 
 Changes in 10.9.3
 -----------------
 - Security Fix browser loading cached page when page full reload (F5) + logout + Back button in warehouse.js, thanks to @b1tch3s
 
diff --git a/ProgramFunctions/FileUpload.fnc.php b/ProgramFunctions/FileUpload.fnc.php
index 0c7eb23167..ed79c7f13d 100644
--- a/ProgramFunctions/FileUpload.fnc.php
+++ b/ProgramFunctions/FileUpload.fnc.php
@@ -406,11 +406,12 @@ function FilesUploadUpdate( $table, $request, $path, $id = 0 )
 			$_FILES[ $input ]['name'],
 			0,
 			mb_strrpos( $_FILES[ $input ]['name'], '.' )
 		) );
 
-		$file_name_no_ext .= '_' . date( 'Y-m-d_His' );
+		// @since 11.0 Add microseconds to filename format to make it harder to predict.
+		$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
 
 		$new_file = FileUpload(
 			$input,
 			$path,
 			FileExtensionWhiteList(),
diff --git a/modules/Accounting/functions.inc.php b/modules/Accounting/functions.inc.php
index b55202c9e8..555152c78b 100644
--- a/modules/Accounting/functions.inc.php
+++ b/modules/Accounting/functions.inc.php
@@ -349,11 +349,12 @@ function _saveSalariesFile( $id )
 		$_FILES[ $input ]['name'],
 		0,
 		mb_strrpos( $_FILES[ $input ]['name'], '.' )
 	) );
 
-	$file_name_no_ext .= '_' . date( 'Y-m-d_His' );
+	// @since 11.0 Add microseconds to filename format to make it harder to predict.
+	$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
 
 	$file_attached = FileUpload(
 		$input,
 		$FileUploadsPath . UserSyear() . '/staff_' . UserStaffID() . '/',
 		FileExtensionWhiteList(),
diff --git a/modules/School_Setup/PortalNotes.php b/modules/School_Setup/PortalNotes.php
index eecf487347..79069a9517 100644
--- a/modules/School_Setup/PortalNotes.php
+++ b/modules/School_Setup/PortalNotes.php
@@ -125,16 +125,28 @@ if ( $_REQUEST['modfunc'] === 'update'
 				// @since 10.9 Fix security issue, unset any FILE_ATTACHED column first.
 				$columns['FILE_ATTACHED'] = '';
 
 				if ( isset( $_FILES['FILE_ATTACHED_FILE'] ) )
 				{
+					$file_name_no_ext = no_accents( mb_substr(
+						$_FILES['FILE_ATTACHED_FILE']['name'],
+						0,
+						mb_strrpos( $_FILES['FILE_ATTACHED_FILE']['name'], '.' )
+					) );
+
+					// @since 11.0 Add microseconds to filename format to make it harder to predict.
+					$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
+
+					// File attached to portal notes
 					$columns['FILE_ATTACHED'] = FileUpload(
 						'FILE_ATTACHED_FILE',
 						$PortalNotesFilesPath,
 						FileExtensionWhiteList(),
 						0,
-						$error
+						$error,
+						'',
+						$file_name_no_ext
 					);
 
 					// @since 6.8 Fix SQL error when quote in uploaded file name.
 					$columns['FILE_ATTACHED'] = DBEscapeString( $columns['FILE_ATTACHED'] );
 				}
diff --git a/modules/Student_Billing/functions.inc.php b/modules/Student_Billing/functions.inc.php
index ea52e84f66..e36e075f3e 100644
--- a/modules/Student_Billing/functions.inc.php
+++ b/modules/Student_Billing/functions.inc.php
@@ -427,11 +427,12 @@ function _saveFeesFile( $id )
 		$_FILES[ $input ]['name'],
 		0,
 		mb_strrpos( $_FILES[ $input ]['name'], '.' )
 	) );
 
-	$file_name_no_ext .= '_' . date( 'Y-m-d_His' );
+	// @since 11.0 Add microseconds to filename format to make it harder to predict.
+	$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
 
 	$file_attached = FileUpload(
 		$input,
 		$FileUploadsPath . UserSyear() . '/student_' . UserStudentID() . '/',
 		FileExtensionWhiteList(),

Vulnerable code: 		$file_name_no_ext .= '_' . date( 'Y-m-d_His' );
	$file_name_no_ext .= '_' . date( 'Y-m-d_His' );
						$error
	$file_name_no_ext .= '_' . date( 'Y-m-d_His' );
Fixed code: - Add microseconds to filename format to make it harder to predict in FileUpload.fnc.php, Accounting/functions.php, PortalNotes.php & Student_Billing/functions.php
		// @since 11.0 Add microseconds to filename format to make it harder to predict.
		$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
	// @since 11.0 Add microseconds to filename format to make it harder to predict.
	$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
					$file_name_no_ext = no_accents( mb_substr(
						$_FILES['FILE_ATTACHED_FILE']['name'],
						0,
						mb_strrpos( $_FILES['FILE_ATTACHED_FILE']['name'], '.' )
					) );

					// @since 11.0 Add microseconds to filename format to make it harder to predict.
					$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );

					// File attached to portal notes
						$error,
						'',
						$file_name_no_ext
	// @since 11.0 Add microseconds to filename format to make it harder to predict.
	$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );