Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2021-3027: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: app/views_mod/user/user.py in LibrIT PaSSHport through 2.5 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided search filter because user input gets no sanitization.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 6.5
Published: 2021-03-26T03:16Z
Repository: https://github.com/LibrIT/passhport
Language: Python
Files changed: passhportd/app/views_mod/user/user.py
Commit date: 2021-01-26 13:09:03 +0100
Commit message: Update user.py

Double check on bind from user input in case of external access of the function
Diff: diff --git a/passhportd/app/views_mod/user/user.py b/passhportd/app/views_mod/user/user.py
index f082da5f..20d7d1cd 100755
--- a/passhportd/app/views_mod/user/user.py
+++ b/passhportd/app/views_mod/user/user.py
@@ -26,11 +26,11 @@ def useruid(s, login):
         app.logger.error("Error connecting to the LDAP with the service account")
         return False
 
     # Look for the user entry.
     if not c.search(config.LDAPBASE,
-                    "(" + config.LDAPFIELD + "=" + login + ")") :
+                    "(" + config.LDAPFIELD + "=" + escape_rdn(login) + ")") :
         app.logger.error("Error: Connection to the LDAP with service account failed")
     else:
         if len(c.entries) >= 1 :
             if len(c.entries) > 1 :
                 app.logger.error("Error: multiple entries with this login. "+ \
@@ -47,11 +47,11 @@ def try_ldap_login(login, password):
     """ Connect to a LDAP directory to verify user login/passwords"""
     result = "Wrong login/password"
     s = Server(config.LDAPURI, port=config.LDAPPORT,
                use_ssl=False, get_info=ALL)
     # 1. connection with service account to find the user uid
-    uid = useruid(s, login)
+    uid = useruid(s, escape_rdn(login))
    
     if uid: 
         # 2. Try to bind the user to the LDAP
         c = Connection(s, user = uid , password = password, auto_bind = True)
         c.open()

Vulnerable code:                     "(" + config.LDAPFIELD + "=" + login + ")") :
    uid = useruid(s, login)
Fixed code:                     "(" + config.LDAPFIELD + "=" + escape_rdn(login) + ")") :
    uid = useruid(s, escape_rdn(login))
CVE-2022-30688: Other (NVD-CWE-Other)
value: needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.8
Published: 2022-05-17T19:15Z
Repository: https://github.com/liske/needrestart
Language: Perl
Files changed: perl/lib/NeedRestart/Interp/Perl.pm, perl/lib/NeedRestart/Interp/Python.pm, perl/lib/NeedRestart/Interp/Ruby.pm
Commit date: 2022-05-17 16:53:14 +0200
Commit message: [Interp] CVE-2022-30688: Anchor interpreter regex to prevent local privilege escalation (reported by Jakub Wilk).

Diff: diff --git a/perl/lib/NeedRestart/Interp/Perl.pm b/perl/lib/NeedRestart/Interp/Perl.pm
index c24c0a5..6fbd640 100644
--- a/perl/lib/NeedRestart/Interp/Perl.pm
+++ b/perl/lib/NeedRestart/Interp/Perl.pm
@@ -41,11 +41,11 @@ needrestart_interp_register(__PACKAGE__);
 sub isa {
     my $self = shift;
     my $pid = shift;
     my $bin = shift;
 
-    return 1 if($bin =~ m@/usr/(local/)?bin/perl@);
+    return 1 if($bin =~ m@^/usr/(local/)?bin/perl(5[.\d]*)?$@);
 
     return 0;
 }
 
 sub source {
diff --git a/perl/lib/NeedRestart/Interp/Python.pm b/perl/lib/NeedRestart/Interp/Python.pm
index c7d385e..e4be37c 100644
--- a/perl/lib/NeedRestart/Interp/Python.pm
+++ b/perl/lib/NeedRestart/Interp/Python.pm
@@ -40,11 +40,11 @@ needrestart_interp_register(__PACKAGE__);
 sub isa {
     my $self = shift;
     my $pid = shift;
     my $bin = shift;
 
-    return 1 if($bin =~ m@/usr/(local/)?bin/python@);
+    return 1 if($bin =~ m@^/usr/(local/)?bin/python([23][.\d]*)?$@);
 
     return 0;
 }
 
 sub _scan($$$$$) {
diff --git a/perl/lib/NeedRestart/Interp/Ruby.pm b/perl/lib/NeedRestart/Interp/Ruby.pm
index 8c7f976..fb69176 100644
--- a/perl/lib/NeedRestart/Interp/Ruby.pm
+++ b/perl/lib/NeedRestart/Interp/Ruby.pm
@@ -40,11 +40,11 @@ needrestart_interp_register(__PACKAGE__);
 sub isa {
     my $self = shift;
     my $pid = shift;
     my $bin = shift;
 
-    return 1 if($bin =~ m@/usr/(local/)?bin/ruby@);
+    return 1 if($bin =~ m@^/usr/(local/)?bin/ruby$@);
 
     return 0;
 }
 
 sub _scan($$$$$) {

Vulnerable code:     return 1 if($bin =~ m@/usr/(local/)?bin/perl@);
    return 1 if($bin =~ m@/usr/(local/)?bin/python@);
    return 1 if($bin =~ m@/usr/(local/)?bin/ruby@);
Fixed code:     return 1 if($bin =~ m@^/usr/(local/)?bin/perl(5[.\d]*)?$@);
    return 1 if($bin =~ m@^/usr/(local/)?bin/python([23][.\d]*)?$@);
    return 1 if($bin =~ m@^/usr/(local/)?bin/ruby$@);
CVE-2021-3934: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
value: ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command
CWE description: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS v3 base score: 7.5
Published: 2021-11-12T12:15Z
Repository: https://github.com/ohmyzsh/ohmyzsh
Language: Other
Files changed: lib/functions.zsh
Commit date: 2021-11-11 22:44:18 +0100
Commit message: fix(lib): fix `omz_urldecode` unsafe eval bug

The `omz_urldecode` function uses an eval to decode the input which can be
exploited to inject commands. This is used only in the svn plugin and it
requires a complex process to exploit, so it is highly unlikely to have been
used by an attacker.

Diff: diff --git a/lib/functions.zsh b/lib/functions.zsh
index fc53611b..61f4dd49 100644
--- a/lib/functions.zsh
+++ b/lib/functions.zsh
@@ -235,16 +235,15 @@ function omz_urldecode {
   local tmp=${encoded_url:gs/+/ /}
   # Protect other escapes to pass through the printf unchanged
   tmp=${tmp:gs/\\/\\\\/}
   # Handle %-escapes by turning them into `\xXX` printf escapes
   tmp=${tmp:gs/%/\\x/}
-  local decoded
-  eval "decoded=\$'$tmp'"
+  local decoded="$(printf -- "$tmp")"
 
   # Now we have a UTF-8 encoded string in the variable. We need to re-encode
   # it if caller is in a non-UTF-8 locale.
-  local safe_encodings
+  local -a safe_encodings
   safe_encodings=(UTF-8 utf8 US-ASCII)
   if [[ -z ${safe_encodings[(r)$caller_encoding]} ]]; then
     decoded=$(echo -E "$decoded" | iconv -f UTF-8 -t $caller_encoding)
     if [[ $? != 0 ]]; then
       echo "Error converting string from UTF-8 to $caller_encoding" >&2

Vulnerable code:   local decoded
  eval "decoded=\$'$tmp'"
  local safe_encodings
Fixed code:   local decoded="$(printf -- "$tmp")"
  local -a safe_encodings
CVE-2020-8498: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g., ones who have the publish_posts capability).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-01-30T23:15Z
Repository: https://github.com/bradyvercher/gistpress
Language: PHP
Files changed: includes/class-gistpress.php
Commit date: 2020-01-16 11:16:56 -0800
Commit message: Sanitize the shortcode id attribute.

Diff: diff --git a/includes/class-gistpress.php b/includes/class-gistpress.php
index c6127e8..9ee484d 100644
--- a/includes/class-gistpress.php
+++ b/includes/class-gistpress.php
@@ -679,10 +679,11 @@ class GistPress {
 			)
 		);
 
 		// Sanitize attributes.
 		$attr = shortcode_atts( $defaults, $rawattr );
+		$attr['id']                = preg_replace( '/[^a-z0-9]+/i', '', $attr['id'] );
 		$attr['embed_stylesheet']  = $this->shortcode_bool( $attr['embed_stylesheet'] );
 		$attr['show_line_numbers'] = $this->shortcode_bool( $attr['show_line_numbers'] );
 		$attr['show_meta']         = $this->shortcode_bool( $attr['show_meta'] );
 		$attr['highlight']         = $this->parse_highlight_arg( $attr['highlight'] );
 		$attr['lines']             = $this->parse_line_number_arg( $attr['lines'] );

Fixed code: 		$attr['id']                = preg_replace( '/[^a-z0-9]+/i', '', $attr['id'] );
CVE-2017-11173: Insufficient Information (NVD-CWE-noinfo)
value: Missing anchor in generated regex for rack-cors before 0.4.1 allows a malicious third-party site to perform CORS requests. If the configuration were intended to allow only the trusted example.com domain name and not the malicious example.net domain name, then example.com.example.net (as well as example.com-example.net) would be inadvertently allowed.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 8.8
Published: 2017-07-13T03:29Z
Repository: https://github.com/cyu/rack-cors
Language: Ruby
Files changed: lib/rack/cors.rb
Commit date: 2015-10-13 13:28:24 -0400
Commit message: Add end string anchor to string origin def

Build regex with end string anchor when string is used to configure
origin

[Fixes #86]

Diff: diff --git a/lib/rack/cors.rb b/lib/rack/cors.rb
index 17d7e25..3d74ebb 100644
--- a/lib/rack/cors.rb
+++ b/lib/rack/cors.rb
@@ -251,11 +251,11 @@ module Rack
             case n
             when Regexp,
                  /^https?:\/\//,
                  'file://'        then n
             when '*'              then @public_resources = true; n
-            else                  Regexp.compile("^[a-z][a-z0-9.+-]*:\\\/\\\/#{Regexp.quote(n)}")
+            else                  Regexp.compile("^[a-z][a-z0-9.+-]*:\\\/\\\/#{Regexp.quote(n)}$")
             end
           end.flatten
           @origins.push(blk) if blk
         end
 

Vulnerable code:             else                  Regexp.compile("^[a-z][a-z0-9.+-]*:\\\/\\\/#{Regexp.quote(n)}")
Fixed code:             else                  Regexp.compile("^[a-z][a-z0-9.+-]*:\\\/\\\/#{Regexp.quote(n)}$")
CVE-2022-1236: Weak Password Requirements (CWE-521)
value: Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.
CWE description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
CVSS v3 base score: 6.5
Published: 2022-04-05T09:15Z
Repository: https://github.com/weseek/growi
Language: Unknown
Commit date: 2022-03-31 14:31:19 +0900
Commit message: Merge pull request #5630 from weseek/imprv/extend-minimum-password-length

fix: Displaying minimum length of password
CVE-2019-25093: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, was found in dragonexpert Recent Threads on Index. Affected is the function recentthread_list_threads of the file inc/plugins/recentthreads/hooks.php of the component Setting Handler. The manipulation of the argument recentthread_forumskip leads to cross site scripting. It is possible to launch the attack remotely. The patch is identified as 051465d807a8fcc6a8b0f4bcbb19299672399f48. It is recommended to apply a patch to fix this issue. VDB-217182 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-01-02T11:15Z
Repository: https://github.com/dragonexpert/recentthreads
Language: PHP
Files changed: inc/plugins/recentthreads/hooks.php
Commit date: 2019-02-06 14:43:27 -0600
Commit message: Update hooks.php

Fixes a low risk XSS vulnerability.  Classified as low risk due to needing access to ACP->Config.
Diff: diff --git a/inc/plugins/recentthreads/hooks.php b/inc/plugins/recentthreads/hooks.php
index ead662d..f8e399b 100644
--- a/inc/plugins/recentthreads/hooks.php
+++ b/inc/plugins/recentthreads/hooks.php
@@ -92,11 +92,11 @@ function recentthread_list_threads($return=false)
         $unsearchableforumssql = " AND t.fid NOT IN(" . implode(",", $newarray) . ") ";
     }
     // Take into account any ignored forums
     if($mybb->settings['recentthread_forumskip'])
     {
-        $ignoreforums = " AND t.fid NOT IN(" . $mybb->settings['recentthread_forumskip'] . ") ";
+        $ignoreforums = " AND t.fid NOT IN(" . htmlspecialchars($mybb->settings['recentthread_forumskip']) . ") ";
     }
     $forums = $cache->read("forums");
     $prefixes = $cache->read("threadprefixes");
 
     // Are we only using certain prefixes?

Vulnerable code:         $ignoreforums = " AND t.fid NOT IN(" . $mybb->settings['recentthread_forumskip'] . ") ";
Fixed code:         $ignoreforums = " AND t.fid NOT IN(" . htmlspecialchars($mybb->settings['recentthread_forumskip']) . ") ";
CVE-2016-6829: Use of Hard-coded Credentials (CWE-798)
value: The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-trove) in the Crowbar Framework has a default password, which makes it easier for remote attackers to obtain access via unspecified vectors.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 9.8
Published: 2016-12-09T20:59Z
Repository: https://github.com/crowbar/crowbar-openstack
Language: Unknown
Commit date: 2016-08-31 07:35:10 +0200
Commit message: Merge pull request #485 from s-t-e-v-e-n-k/trove-random-password

Set the trove service password to random
CVE-2024-31226: Insufficient Information (NVD-CWE-noinfo)
value: Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named `C:\Program.exe`, `C:\Program.bat`, or `C:\Program.cmd` on the user's computer. This attack vector isn't exploitable unless the user has manually loosened ACLs on the system drive. If the user's system locale is not English, then the name of the executable will likely vary. Version 0.23.0 contains a patch for the issue. Some workarounds are available. One may identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate. Alternatively, ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory `C:`. Require that all executables be placed in write-protected directories.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-16T19:15Z
Repository: https://github.com/LizardByte/Sunshine
Language: C++
Files changed: tools/sunshinesvc.cpp
Commit date: 2024-04-06 19:21:03 -0400
Commit message: Quote the path to sunshinesvc.exe when launching the termination helper (#2379)


Diff: diff --git a/tools/sunshinesvc.cpp b/tools/sunshinesvc.cpp
index fee3a693..da0849e2 100644
--- a/tools/sunshinesvc.cpp
+++ b/tools/sunshinesvc.cpp
@@ -143,23 +143,26 @@ OpenLogFileHandle() {
 
 bool
 RunTerminationHelper(HANDLE console_token, DWORD pid) {
   WCHAR module_path[MAX_PATH];
   GetModuleFileNameW(NULL, module_path, _countof(module_path));
-  std::wstring command { module_path };
+  std::wstring command;
 
+  command += L'"';
+  command += module_path;
+  command += L'"';
   command += L" --terminate " + std::to_wstring(pid);
 
   STARTUPINFOW startup_info = {};
   startup_info.cb = sizeof(startup_info);
   startup_info.lpDesktop = (LPWSTR) L"winsta0\\default";
 
   // Execute ourselves as a detached process in the user session with the --terminate argument.
   // This will allow us to attach to Sunshine's console and send it a Ctrl-C event.
   PROCESS_INFORMATION process_info;
   if (!CreateProcessAsUserW(console_token,
-        NULL,
+        module_path,
         (LPWSTR) command.c_str(),
         NULL,
         NULL,
         FALSE,
         CREATE_UNICODE_ENVIRONMENT | DETACHED_PROCESS,

Vulnerable code:   std::wstring command { module_path };
        NULL,
Fixed code:   std::wstring command;
  command += L'"';
  command += module_path;
  command += L'"';
        module_path,
CVE-2018-1000165: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 7.5
Published: 2018-04-18T19:29Z
Repository: https://github.com/lightSAML/lightSAML
Language: PHP
Files changed: src/LightSaml/Model/XmlDSig/AbstractSignatureReader.php
Commit date: 2018-03-05 17:26:57 +0100
Commit message: Check for supported signature algorithms

Diff: diff --git a/src/LightSaml/Model/XmlDSig/AbstractSignatureReader.php b/src/LightSaml/Model/XmlDSig/AbstractSignatureReader.php
index e434d84..65985b1 100644
--- a/src/LightSaml/Model/XmlDSig/AbstractSignatureReader.php
+++ b/src/LightSaml/Model/XmlDSig/AbstractSignatureReader.php
@@ -60,11 +60,11 @@ abstract class AbstractSignatureReader extends Signature
 
             try {
                 $result = $this->validate($credential->getPublicKey());
 
                 if ($result === false) {
-                    return;
+                    return null;
                 }
 
                 return $credential;
             } catch (LightSamlSecurityException $ex) {
                 $lastException = $ex;
@@ -89,10 +89,20 @@ abstract class AbstractSignatureReader extends Signature
      * @return XMLSecurityKey
      */
     protected function castKeyIfNecessary(XMLSecurityKey $key)
     {
         $algorithm = $this->getAlgorithm();
+
+        if (!in_array($algorithm, [
+            XMLSecurityKey::RSA_SHA1,
+            XMLSecurityKey::RSA_SHA256,
+            XMLSecurityKey::RSA_SHA384,
+            XMLSecurityKey::RSA_SHA512,
+        ])) {
+            throw new LightSamlSecurityException(sprintf('Unsupported signing algorithm: "%s"', $algorithm));
+        }
+
         if ($algorithm != $key->type) {
             $key = KeyHelper::castKey($key, $algorithm);
         }
 
         return $key;

Vulnerable code:                     return;
Fixed code:                     return null;

        if (!in_array($algorithm, [
            XMLSecurityKey::RSA_SHA1,
            XMLSecurityKey::RSA_SHA256,
            XMLSecurityKey::RSA_SHA384,
            XMLSecurityKey::RSA_SHA512,
        ])) {
            throw new LightSamlSecurityException(sprintf('Unsupported signing algorithm: "%s"', $algorithm));
        }
CVE-2012-1188: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name parameter to private/en/locale/index.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-26T00:55Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: backend/modules/error/actions/index.php
Commit date: 2012-02-28 18:16:27 +0100
Commit message: resolve xss vulnerability

Diff: diff --git a/backend/modules/error/actions/index.php b/backend/modules/error/actions/index.php
index e793226c..18726512 100644
--- a/backend/modules/error/actions/index.php
+++ b/backend/modules/error/actions/index.php
@@ -70,8 +70,8 @@ class BackendErrorIndex extends BackendBaseActionIndex
 				exit;
 			}
 		}
 
 		// assign the correct message into the template
-		$this->tpl->assign('message', BL::err(SpoonFilter::toCamelCase($errorType, '-')));
+		$this->tpl->assign('message', BL::err(SpoonFilter::toCamelCase(htmlspecialchars($errorType), '-')));
 	}
 }

Vulnerable code: 		$this->tpl->assign('message', BL::err(SpoonFilter::toCamelCase($errorType, '-')));
Fixed code: 		$this->tpl->assign('message', BL::err(SpoonFilter::toCamelCase(htmlspecialchars($errorType), '-')));
CVE-2012-1188: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name parameter to private/en/locale/index.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-26T00:55Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: backend/modules/error/actions/index.php
Commit date: 2012-02-28 18:35:43 +0100
Commit message: fix xss vulnerability

Diff: diff --git a/backend/modules/error/actions/index.php b/backend/modules/error/actions/index.php
index 18726512c..e491a305c 100644
--- a/backend/modules/error/actions/index.php
+++ b/backend/modules/error/actions/index.php
@@ -62,11 +62,11 @@ class BackendErrorIndex extends BackendBaseActionIndex
 			{
 				// set correct headers
 				SpoonHTTP::setHeadersByCode(404);
 
 				// give a nice error, so we can detect which file is missing
-				echo 'Requested file (' . implode('?', $chunks) . ') not found.';
+				echo 'Requested file (' . htmlspecialchars($this->getParameter('querystring')) . ') not found.';
 
 				// stop script execution
 				exit;
 			}
 		}

Vulnerable code: 				echo 'Requested file (' . implode('?', $chunks) . ') not found.';
Fixed code: 				echo 'Requested file (' . htmlspecialchars($this->getParameter('querystring')) . ') not found.';
CVE-2012-1207: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter to frontend/js.php.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Published: 2012-02-24T13:55Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: frontend/core/engine/javascript.php
Commit date: 2012-02-13 16:13:35 +0100
Commit message: XSS / LFI Fox

Diff: diff --git a/frontend/core/engine/javascript.php b/frontend/core/engine/javascript.php
index 8de23787d..b25b0a138 100644
--- a/frontend/core/engine/javascript.php
+++ b/frontend/core/engine/javascript.php
@@ -192,8 +192,19 @@ class FrontendJavascript
 	 *
 	 * @param string $value The module.
 	 */
 	private function setModule($value)
 	{
+		$modules = (array) FrontendModel::getModules();
+		
+		if(!in_array((string) $value, $modules))
+		{
+			// when debug is on throw an exception
+			if(SPOON_DEBUG) throw new FrontendException('Invalid file.');
+
+			// when debug is of show a descent message
+			else exit(SPOON_DEBUG_MESSAGE);
+		}
+		
 		$this->module = (string) $value;
 	}
 }

Fixed code: 		$modules = (array) FrontendModel::getModules();
		
		if(!in_array((string) $value, $modules))
		{
			// when debug is on throw an exception
			if(SPOON_DEBUG) throw new FrontendException('Invalid file.');

			// when debug is of show a descent message
			else exit(SPOON_DEBUG_MESSAGE);
		}
CVE-2012-1208: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) report parameter to blog/settings or (2) error parameter to users/index.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-02-24T13:55Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: backend/core/engine/base.php
Commit date: 2012-02-14 09:12:17 +0100
Commit message: Disallow html in the report.

Diff: diff --git a/backend/core/engine/base.php b/backend/core/engine/base.php
index a263deaed..ff9ef41d0 100644
--- a/backend/core/engine/base.php
+++ b/backend/core/engine/base.php
@@ -146,11 +146,11 @@ class BackendBaseAction
 		{
 			// show the report
 			$this->tpl->assign('report', true);
 
 			// camelcase the string
-			$messageName = SpoonFilter::toCamelCase($this->getParameter('report'), '-');
+			$messageName = strip_tags(SpoonFilter::toCamelCase($this->getParameter('report'), '-'));
 
 			// if we have data to use it will be passed as the var parameter
 			if(!empty($var)) $this->tpl->assign('reportMessage', vsprintf(BL::msg($messageName), $var));
 			else $this->tpl->assign('reportMessage', BL::msg($messageName));
 

Vulnerable code: 			$messageName = SpoonFilter::toCamelCase($this->getParameter('report'), '-');
Fixed code: 			$messageName = strip_tags(SpoonFilter::toCamelCase($this->getParameter('report'), '-'));
CVE-2012-1208: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) report parameter to blog/settings or (2) error parameter to users/index.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-02-24T13:55Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: backend/core/engine/base.php
Commit date: 2012-02-14 09:17:46 +0100
Commit message: Make sure the error doesn't contain any html tags.

Diff: diff --git a/backend/core/engine/base.php b/backend/core/engine/base.php
index 73c0a83ff..e4d73070e 100644
--- a/backend/core/engine/base.php
+++ b/backend/core/engine/base.php
@@ -163,11 +163,11 @@ class BackendBaseAction
 
 		// is there an error to show?
 		if($this->getParameter('error') !== null)
 		{
 			// camelcase the string
-			$errorName = SpoonFilter::toCamelCase($this->getParameter('error'), '-');
+			$errorName = strip_tags(SpoonFilter::toCamelCase($this->getParameter('error'), '-'));
 
 			// if we have data to use it will be passed as the var parameter
 			if(!empty($var)) $this->tpl->assign('errorMessage', vsprintf(BL::err($errorName), $var));
 			else $this->tpl->assign('errorMessage', BL::err($errorName));
 		}

Vulnerable code: 			$errorName = SpoonFilter::toCamelCase($this->getParameter('error'), '-');
Fixed code: 			$errorName = strip_tags(SpoonFilter::toCamelCase($this->getParameter('error'), '-'));
CVE-2012-1209: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-02-24T13:55Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: backend/core/engine/base.php
Commit date: 2012-02-14 09:16:47 +0100
Commit message: Make sure the highlight string doesn't contain html tags.

Diff: diff --git a/backend/core/engine/base.php b/backend/core/engine/base.php
index ff9ef41d0..73c0a83ff 100644
--- a/backend/core/engine/base.php
+++ b/backend/core/engine/base.php
@@ -153,11 +153,14 @@ class BackendBaseAction
 			// if we have data to use it will be passed as the var parameter
 			if(!empty($var)) $this->tpl->assign('reportMessage', vsprintf(BL::msg($messageName), $var));
 			else $this->tpl->assign('reportMessage', BL::msg($messageName));
 
 			// highlight an element with the given id if needed
-			if($this->getParameter('highlight')) $this->tpl->assign('highlight', $this->getParameter('highlight'));
+			if($this->getParameter('highlight'))
+			{
+				$this->tpl->assign('highlight', strip_tags($this->getParameter('highlight')));
+			}
 		}
 
 		// is there an error to show?
 		if($this->getParameter('error') !== null)
 		{

Vulnerable code: 			if($this->getParameter('highlight')) $this->tpl->assign('highlight', $this->getParameter('highlight'));
Fixed code: 			if($this->getParameter('highlight'))
			{
				$this->tpl->assign('highlight', strip_tags($this->getParameter('highlight')));
			}
CVE-2012-5164: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the term parameter to (1) autocomplete.php, (2) search/ajax/autosuggest.php, (3) livesuggest.php, or (4) save.php in frontend/modules/search/ajax.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2012-09-26T00:55Z
Repository: https://github.com/forkcms/forkcms
Language: Unknown
Commit date: 2012-03-01 02:29:10 -0800
Commit message: Merge pull request #247 from jelmersnoeck/xss-fix-ajax-search

XSS: Escape the input on ajax searches.
CVE-2014-9470: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork CMS before 3.8.4 allows remote attackers to inject arbitrary web script or HTML via the q_widget parameter to en/search.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-02-08T17:15Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: src/Frontend/Modules/Search/Actions/Index.php
Commit date: 2014-12-26 08:09:59 +0100
Commit message: Don't directly inject $_GET parameters in html.

The Search module created a canonical tag containing a directly injected
$_GET parameter. This commit makes sure we encode specialcharacters
making XSS impossible. Fixes #1018

Diff: diff --git a/src/Frontend/Modules/Search/Actions/Index.php b/src/Frontend/Modules/Search/Actions/Index.php
index 573aab0c3d..419cd13865 100644
--- a/src/Frontend/Modules/Search/Actions/Index.php
+++ b/src/Frontend/Modules/Search/Actions/Index.php
@@ -244,11 +244,11 @@ class Index extends FrontendBaseBlock
         );
 
         // since we know the term just here we should set the canonical url here
         $canonicalUrl = SITE_URL . FrontendNavigation::getURLForBlock('Search');
         if (isset($_GET['q']) && $_GET['q'] != '') {
-            $canonicalUrl .= '?q=' . $_GET['q'];
+            $canonicalUrl .= '?q=' . \SpoonFilter::htmlspecialchars($_GET['q']);
         }
         $this->header->setCanonicalUrl($canonicalUrl);
     }
 
     /**

Vulnerable code:             $canonicalUrl .= '?q=' . $_GET['q'];
Fixed code:             $canonicalUrl .= '?q=' . \SpoonFilter::htmlspecialchars($_GET['q']);
CVE-2022-0145: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-24T11:15Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: src/Backend/Modules/Extensions/Engine/Model.php
Commit date: 2022-03-23 14:20:39 +0100
Commit message: Fix xss though the description in the info.xml file of a theme or module

Diff: diff --git a/src/Backend/Modules/Extensions/Engine/Model.php b/src/Backend/Modules/Extensions/Engine/Model.php
index 4e09814e26..3d81361271 100644
--- a/src/Backend/Modules/Extensions/Engine/Model.php
+++ b/src/Backend/Modules/Extensions/Engine/Model.php
@@ -837,11 +837,11 @@ class Model
 
         // fetch general module info
         $information['name'] = (string) $module->name;
         $information['version'] = (string) $module->version;
         $information['requirements'] = (array) $module->requirements;
-        $information['description'] = (string) $module->description;
+        $information['description'] = strip_tags((string) $module->description, '<h1><h2><h3><h4><h5><h6><p><li><a>');
         $information['cronjobs'] = [];
 
         // authors
         foreach ($xml->xpath('/module/authors/author') as $author) {
             $information['authors'][] = (array) $author;
@@ -898,11 +898,11 @@ class Model
         // fetch general theme info
         $information['name'] = (string) $theme->name;
         $information['version'] = (string) $theme->version;
         $information['requirements'] = (array) $theme->requirements;
         $information['thumbnail'] = (string) $theme->thumbnail;
-        $information['description'] = (string) $theme->description;
+        $information['description'] = strip_tags((string) $theme->description, '<h1><h2><h3><h4><h5><h6><p><li><a>');
 
         // authors
         foreach ($xml->xpath('/theme/authors/author') as $author) {
             $information['authors'][] = (array) $author;
         }

Vulnerable code:         $information['description'] = (string) $module->description;
        $information['description'] = (string) $theme->description;
Fixed code:         $information['description'] = strip_tags((string) $module->description, '<h1><h2><h3><h4><h5><h6><p><li><a>');
        $information['description'] = strip_tags((string) $theme->description, '<h1><h2><h3><h4><h5><h6><p><li><a>');
CVE-2022-0153: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 7.5
Published: 2022-03-24T17:15Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: src/Backend/Modules/FormBuilder/Engine/Model.php
Commit date: 2022-03-23 13:16:53 +0100
Commit message: Prevent sql injection through the ids of the action

Diff: diff --git a/src/Backend/Modules/FormBuilder/Engine/Model.php b/src/Backend/Modules/FormBuilder/Engine/Model.php
index 6a13543526..6028b7607f 100644
--- a/src/Backend/Modules/FormBuilder/Engine/Model.php
+++ b/src/Backend/Modules/FormBuilder/Engine/Model.php
@@ -150,10 +150,11 @@ class Model
      * @param array $ids Ids of data items.
      */
     public static function deleteData(array $ids): void
     {
         $database = BackendModel::getContainer()->get('database');
+        $ids = array_map('intval', $ids);
 
         $database->delete('forms_data', 'id IN(' . implode(',', $ids) . ')');
         $database->delete('forms_data_fields', 'data_id IN(' . implode(',', $ids) . ')');
     }
 

Fixed code:         $ids = array_map('intval', $ids);
CVE-2022-1064: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 8.8
Published: 2022-03-25T12:15Z
Repository: https://github.com/forkcms/forkcms
Language: PHP
Files changed: src/Backend/Modules/Blog/Engine/Model.php
Commit date: 2022-03-23 13:21:47 +0100
Commit message: Prevent sql injection through the ids of the blog comments

Diff: diff --git a/src/Backend/Modules/Blog/Engine/Model.php b/src/Backend/Modules/Blog/Engine/Model.php
index 6ee1dce527..129cfdf55a 100644
--- a/src/Backend/Modules/Blog/Engine/Model.php
+++ b/src/Backend/Modules/Blog/Engine/Model.php
@@ -499,11 +499,11 @@ class Model
     {
         return (array) BackendModel::getContainer()->get('database')->getRecords(
             'SELECT *
              FROM blog_comments AS i
              WHERE i.id IN (' . implode(', ', array_fill(0, count($ids), '?')) . ')',
-            $ids
+            array_map('intval', $ids)
         );
     }
 
     /**
      * Get a count per comment

Vulnerable code:             $ids
Fixed code:             array_map('intval', $ids)
CVE-2023-5217: Out-of-bounds Write (CWE-787)
value: Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2023-09-28T16:15Z
Repository: https://github.com/webmproject/libvpx
Language: C++
Files changed: test/encode_api_test.cc, vp8/encoder/onyx_if.c
Commit date: 2023-09-25 19:33:07 -0700
Commit message: VP8: disallow thread count changes

Currently allocations are done at encoder creation time. Going from
threaded to non-threaded would cause a crash.

Bug: chromium:1486441
Change-Id: Ie301c2a70847dff2f0daae408fbef1e4d42e73d4

Diff: diff --git a/test/encode_api_test.cc b/test/encode_api_test.cc
index a8a4df2ddf..f1c98b2c71 100644
--- a/test/encode_api_test.cc
+++ b/test/encode_api_test.cc
@@ -368,14 +368,10 @@ TEST(EncodeAPI, ConfigResizeChangeThreadCount) {
   constexpr int kInitWidth = 1024;
   constexpr int kInitHeight = 1024;
 
   for (const auto *iface : kCodecIfaces) {
     SCOPED_TRACE(vpx_codec_iface_name(iface));
-    if (!IsVP9(iface)) {
-      GTEST_SKIP() << "TODO(https://crbug.com/1486441) remove this condition "
-                      "after VP8 is fixed.";
-    }
     for (int i = 0; i < (IsVP9(iface) ? 2 : 1); ++i) {
       vpx_codec_enc_cfg_t cfg = {};
       struct Encoder {
         ~Encoder() { EXPECT_EQ(vpx_codec_destroy(&ctx), VPX_CODEC_OK); }
         vpx_codec_ctx_t ctx = {};
diff --git a/vp8/encoder/onyx_if.c b/vp8/encoder/onyx_if.c
index c65afc643b..c5e9970c3c 100644
--- a/vp8/encoder/onyx_if.c
+++ b/vp8/encoder/onyx_if.c
@@ -1445,10 +1445,15 @@ void vp8_change_config(VP8_COMP *cpi, VP8_CONFIG *oxcf) {
 
   last_w = cpi->oxcf.Width;
   last_h = cpi->oxcf.Height;
   prev_number_of_layers = cpi->oxcf.number_of_layers;
 
+  if (cpi->initial_width) {
+    // TODO(https://crbug.com/1486441): Allow changing thread counts; the
+    // allocation is done once in vp8_create_compressor().
+    oxcf->multi_threaded = cpi->oxcf.multi_threaded;
+  }
   cpi->oxcf = *oxcf;
 
   switch (cpi->oxcf.Mode) {
     case MODE_REALTIME:
       cpi->pass = 0;

Vulnerable code:     if (!IsVP9(iface)) {
      GTEST_SKIP() << "TODO(https://crbug.com/1486441) remove this condition "
                      "after VP8 is fixed.";
    }
Fixed code:   if (cpi->initial_width) {
    // TODO(https://crbug.com/1486441): Allow changing thread counts; the
    // allocation is done once in vp8_create_compressor().
    oxcf->multi_threaded = cpi->oxcf.multi_threaded;
  }
CVE-2016-7144: Improper Authentication (CWE-287)
value: The m_authenticate function in modules/m_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 8.1
Published: 2017-01-18T17:59Z
Repository: https://github.com/unrealircd/unrealircd
Language: C
Files changed: src/modules/m_sasl.c
Commit date: 2016-09-03 20:08:21 +0200
Commit message: Fix AUTHENTICATE bug

Diff: diff --git a/src/modules/m_sasl.c b/src/modules/m_sasl.c
index 51ed0eae..b53818a9 100644
--- a/src/modules/m_sasl.c
+++ b/src/modules/m_sasl.c
@@ -228,10 +228,16 @@ CMD_FUNC(m_authenticate)
 	{
 		sendto_one(sptr, err_str(ERR_SASLALREADY), me.name, BadPtr(sptr->name) ? "*" : sptr->name);
 		return 0;
 	}
 
+	if ((parv[1][0] == ':') || strchr(parv[1], ' '))
+	{
+		sendto_one(sptr, err_str(ERR_CANNOTDOCOMMAND), me.name, "*", "AUTHENTICATE", "Invalid parameter");
+		return 0;
+	}
+
 	if (strlen(parv[1]) > 400)
 	{
 		sendto_one(sptr, err_str(ERR_SASLTOOLONG), me.name, BadPtr(sptr->name) ? "*" : sptr->name);
 		return 0;
 	}

Fixed code: 	if ((parv[1][0] == ':') || strchr(parv[1], ' '))
	{
		sendto_one(sptr, err_str(ERR_CANNOTDOCOMMAND), me.name, "*", "AUTHENTICATE", "Invalid parameter");
		return 0;
	}
CVE-2014-125076: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in NoxxieNl Criminals. It has been classified as critical. Affected is an unknown function of the file ingame/roulette.php. The manipulation of the argument gambleMoney leads to sql injection. The patch is identified as 0a60b31271d4cbf8babe4be993d2a3a1617f0897. It is recommended to apply a patch to fix this issue. VDB-218022 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-11T19:15Z
Repository: https://github.com/NoxxieNl/Criminals
Language: PHP
Files changed: ingame/roulette.php
Commit date: 2014-12-22 08:07:06 +0100
Commit message: SQL Injection fix
Diff: diff --git a/ingame/roulette.php b/ingame/roulette.php
index 4ca8e72..1881bcd 100644
--- a/ingame/roulette.php
+++ b/ingame/roulette.php
@@ -78,15 +78,15 @@ if ($_SERVER['REQUEST_METHOD'] == 'POST') {
             $numberPlayer = $_POST['number'];
         }
 
         // user won
         if ($numberWon == $numberPlayer) {
-            $dbCon->query('UPDATE users SET cash = (cash + "' . (int) ($_POST['gambleMoney'] * 36) . '") WHERE id = "' . $userData['id'] . '"');
+            $dbCon->query('UPDATE users SET cash = (cash + "' . (int) (addslashes($_POST['gambleMoney']) * 36) . '") WHERE id = "' . $userData['id'] . '"');
             $tpl->assign('success', 'Je hebt de roulette gewonnen je wint 36x je inzet!');
         } else {
             // user lost
-            $dbCon->query('UPDATE users SET cash = (cash - "' . $_POST['gambleMoney'] . '") WHERE id = "' . $userData['id'] . '"');
+            $dbCon->query('UPDATE users SET cash = (cash - "' . (int) addslashes($_POST['gambleMoney']) . '") WHERE id = "' . $userData['id'] . '"');
             $tpl->assign('form_error', 'Helaas je hebt verloren, gelukkig heb je alleen je inzet verloren!');
         }
     }
 }
 

Vulnerable code:             $dbCon->query('UPDATE users SET cash = (cash + "' . (int) ($_POST['gambleMoney'] * 36) . '") WHERE id = "' . $userData['id'] . '"');
            $dbCon->query('UPDATE users SET cash = (cash - "' . $_POST['gambleMoney'] . '") WHERE id = "' . $userData['id'] . '"');
Fixed code:             $dbCon->query('UPDATE users SET cash = (cash + "' . (int) (addslashes($_POST['gambleMoney']) * 36) . '") WHERE id = "' . $userData['id'] . '"');
            $dbCon->query('UPDATE users SET cash = (cash - "' . (int) addslashes($_POST['gambleMoney']) . '") WHERE id = "' . $userData['id'] . '"');
CVE-2020-28037: Improper Check for Unusual or Exceptional Conditions (CWE-754)
value: is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).
CWE description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CVSS v3 base score: 9.8
Published: 2020-11-02T21:15Z
Repository: https://github.com/WordPress/wordpress-develop
Language: PHP
Files changed: src/wp-includes/functions.php
Commit date: 2020-10-29 18:03:35 +0000
Commit message: Upgrade/install: Improve logic check when determining installation status.

Improve handling of ambiguous return values to determine if a blog is installed.

Props zieladam, xknown.
Merges [49377] to trunk.

git-svn-id: https://develop.svn.wordpress.org/trunk@49386 602fd350-edb4-49c9-b593-d223f7449a82

Diff: diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php
index 537425d898..3d0412630e 100644
--- a/src/wp-includes/functions.php
+++ b/src/wp-includes/functions.php
@@ -1754,11 +1754,12 @@ function is_blog_installed() {
 		}
 		if ( defined( 'CUSTOM_USER_META_TABLE' ) && CUSTOM_USER_META_TABLE == $table ) {
 			continue;
 		}
 
-		if ( ! $wpdb->get_results( "DESCRIBE $table;" ) ) {
+		$described_table = $wpdb->get_results( "DESCRIBE $table;" );
+		if ( is_array( $described_table ) && count( $described_table ) === 0 ) {
 			continue;
 		}
 
 		// One or more tables exist. We are insane.
 

Vulnerable code: 		if ( ! $wpdb->get_results( "DESCRIBE $table;" ) ) {
Fixed code: 		$described_table = $wpdb->get_results( "DESCRIBE $table;" );
		if ( is_array( $described_table ) && count( $described_table ) === 0 ) {