CVE-2023-0994: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 7.5
Published: 2023-02-24T02:15Z
Repository: https://github.com/francoisjacquet/rosariosis
Language: PHP
Files changed: CHANGES.md, modules/Grades/includes/StudentAssignments.fnc.php
Commit date: 2023-02-19 13:18:12 +0100
Commit message: PHP<7 Fix add microseconds to filename to make it harder to predict

Diff: diff --git a/CHANGES.md b/CHANGES.md
index 1bf23313f..aadf2c596 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,8 +1,12 @@
 # CHANGES
 ## RosarioSIS Student Information System
 
+Changes in 10.8.2
+-----------------
+- PHP<7 Fix add microseconds to filename to make it harder to predict in StudentAssignments.fnc.php, thanks to @jeffreygaor
+
 Changes in 10.8.1
 -----------------
 - Use CheckBoxOnclick() in StudentBalances.php & Schedule.inc.php
 - Fix SQL error when Quarter with Assignments is deleted in Portal.php
 - SQL Check requested assignment belongs to current Marking Period in Assignments.php
diff --git a/modules/Grades/includes/StudentAssignments.fnc.php b/modules/Grades/includes/StudentAssignments.fnc.php
index fcc368c5f..7b46bb607 100644
--- a/modules/Grades/includes/StudentAssignments.fnc.php
+++ b/modules/Grades/includes/StudentAssignments.fnc.php
@@ -63,14 +63,12 @@ function StudentAssignmentSubmit( $assignment_id, &$error )
 
 	// TODO: check if Student not dropped?
 
 	$files = issetVal( $old_data['files'] );
 
-	$timestamp = new \DateTime();
-
 	// @since 8.9.5 Add microseconds to filename format to make it harder to predict.
-	$timestamp = $timestamp->format( 'Y-m-d H:i:s.u' );
+	$timestamp = date( 'Y-m-d His' ) . '.' . substr( (string) microtime(), 2, 6 );
 
 	$assignments_path = GetAssignmentsFilesPath( $assignment['STAFF_ID'] );
 
 	// Check if file submitted.
 	if ( isset( $_FILES['submission_file'] ) )
@@ -528,14 +526,12 @@ function UploadAssignmentTeacherFile( $assignment_id, $teacher_id, $file_input_i
 	if ( ! $assignment )
 	{
 		return '';
 	}
 
-	$microseconds = new \DateTime();
-
 	// @since 9.0 Add microseconds to filename format to make it harder to predict.
-	$microseconds = $microseconds->format( 'u' );
+	$microseconds = substr( (string) microtime(), 2, 6 );
 
 	// Filename = [course_title]_[assignment_ID].ext.
 	$file_name_no_ext = no_accents( $assignment['COURSE_TITLE'] . '_' . $assignment_id . '.' . $microseconds );
 
 	if ( ! empty( $assignment['FILE'] )

Vulnerable code: 	$timestamp = new \DateTime();

	$timestamp = $timestamp->format( 'Y-m-d H:i:s.u' );
	$microseconds = new \DateTime();

	$microseconds = $microseconds->format( 'u' );
Fixed code: Changes in 10.8.2
-----------------
- PHP<7 Fix add microseconds to filename to make it harder to predict in StudentAssignments.fnc.php, thanks to @jeffreygaor

	$timestamp = date( 'Y-m-d His' ) . '.' . substr( (string) microtime(), 2, 6 );
	$microseconds = substr( (string) microtime(), 2, 6 );