CVE-2017-12775: Improper Input Validation (CWE-20)
value: qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2017-08-29T15:29Z
Repository: https://github.com/q2a/question2answer
Language: PHP
Files changed: qa-include/qa-install.php
Commit date: 2017-08-08 16:47:32 +0100
Commit message: Security fix in qa-install.php

Diff: diff --git a/qa-include/qa-install.php b/qa-include/qa-install.php
index 8ada9f7..4c11d21 100644
--- a/qa-include/qa-install.php
+++ b/qa-include/qa-install.php
@@ -63,31 +63,34 @@ $hidden = array();
 
 
 // Process user handling higher up to avoid 'headers already sent' warning
 
 if (!isset($pass_failure_type) && qa_clicked('super')) {
+	require_once QA_INCLUDE_DIR.'db/admin.php';
 	require_once QA_INCLUDE_DIR.'db/users.php';
 	require_once QA_INCLUDE_DIR.'app/users-edit.php';
 
-	$inemail = qa_post_text('email');
-	$inpassword = qa_post_text('password');
-	$inhandle = qa_post_text('handle');
+	if (qa_db_count_users() == 0) { // prevent creating multiple accounts
+		$inemail = qa_post_text('email');
+		$inpassword = qa_post_text('password');
+		$inhandle = qa_post_text('handle');
 
-	$fielderrors = array_merge(
-		qa_handle_email_filter($inhandle, $inemail),
-		qa_password_validate($inpassword)
-	);
+		$fielderrors = array_merge(
+			qa_handle_email_filter($inhandle, $inemail),
+			qa_password_validate($inpassword)
+		);
 
-	if (empty($fielderrors)) {
-		require_once QA_INCLUDE_DIR.'app/users.php';
+		if (empty($fielderrors)) {
+			require_once QA_INCLUDE_DIR.'app/users.php';
 
-		$userid = qa_create_new_user($inemail, $inpassword, $inhandle, QA_USER_LEVEL_SUPER);
-		qa_set_logged_in_user($userid, $inhandle);
+			$userid = qa_create_new_user($inemail, $inpassword, $inhandle, QA_USER_LEVEL_SUPER);
+			qa_set_logged_in_user($userid, $inhandle);
 
-		qa_set_option('feedback_email', $inemail);
+			qa_set_option('feedback_email', $inemail);
 
-		$success .= "Congratulations - Your Question2Answer site is ready to go!\n\nYou are logged in as the super administrator and can start changing settings.\n\nThank you for installing Question2Answer.";
+			$success .= "Congratulations - Your Question2Answer site is ready to go!\n\nYou are logged in as the super administrator and can start changing settings.\n\nThank you for installing Question2Answer.";
+		}
 	}
 }
 
 
 //	Output start of HTML early, so we can see a nicely-formatted list of database queries when upgrading

Vulnerable code: 	$inemail = qa_post_text('email');
	$inpassword = qa_post_text('password');
	$inhandle = qa_post_text('handle');
	$fielderrors = array_merge(
		qa_handle_email_filter($inhandle, $inemail),
		qa_password_validate($inpassword)
	);
	if (empty($fielderrors)) {
		require_once QA_INCLUDE_DIR.'app/users.php';
		$userid = qa_create_new_user($inemail, $inpassword, $inhandle, QA_USER_LEVEL_SUPER);
		qa_set_logged_in_user($userid, $inhandle);
		qa_set_option('feedback_email', $inemail);
		$success .= "Congratulations - Your Question2Answer site is ready to go!\n\nYou are logged in as the super administrator and can start changing settings.\n\nThank you for installing Question2Answer.";
Fixed code: 	require_once QA_INCLUDE_DIR.'db/admin.php';
	if (qa_db_count_users() == 0) { // prevent creating multiple accounts
		$inemail = qa_post_text('email');
		$inpassword = qa_post_text('password');
		$inhandle = qa_post_text('handle');
		$fielderrors = array_merge(
			qa_handle_email_filter($inhandle, $inemail),
			qa_password_validate($inpassword)
		);
		if (empty($fielderrors)) {
			require_once QA_INCLUDE_DIR.'app/users.php';
			$userid = qa_create_new_user($inemail, $inpassword, $inhandle, QA_USER_LEVEL_SUPER);
			qa_set_logged_in_user($userid, $inhandle);
			qa_set_option('feedback_email', $inemail);
			$success .= "Congratulations - Your Question2Answer site is ready to go!\n\nYou are logged in as the super administrator and can start changing settings.\n\nThank you for installing Question2Answer.";
		}