CVE-2020-12669: Improper Input Validation (CWE-20)
value: core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 8.8
Published: 2020-05-06T19:15Z
Repository: https://github.com/Dolibarr/dolibarr
Language: PHP
Files changed: htdocs/core/get_menudiv.php
Commit date: 2020-05-01 15:56:01 +0200
Commit message: Merge branch '11.0' of git@github.com:Dolibarr/dolibarr.git into develop

Conflicts:
	htdocs/core/get_menudiv.php

Diff: diff --cc htdocs/core/get_menudiv.php
index 5105fe2201b8,af64d0659311..92b8dc34a0e4
--- a/htdocs/core/get_menudiv.php
+++ b/htdocs/core/get_menudiv.php
@@@ -174,38 -174,38 +174,38 @@@ $(document).ready(function()
  ';
  
  
  if (empty($user->socid))	// If internal user or not defined
  {
 -	$conf->standard_menu=(empty($conf->global->MAIN_MENU_STANDARD_FORCED)?(empty($conf->global->MAIN_MENU_STANDARD)?'eldy_menu.php':$conf->global->MAIN_MENU_STANDARD):$conf->global->MAIN_MENU_STANDARD_FORCED);
 +	$conf->standard_menu = (empty($conf->global->MAIN_MENU_STANDARD_FORCED) ? (empty($conf->global->MAIN_MENU_STANDARD) ? 'eldy_menu.php' : $conf->global->MAIN_MENU_STANDARD) : $conf->global->MAIN_MENU_STANDARD_FORCED);
  }
  else                        	// If external user
  {
 -	$conf->standard_menu=(empty($conf->global->MAIN_MENUFRONT_STANDARD_FORCED)?(empty($conf->global->MAIN_MENUFRONT_STANDARD)?'eldy_menu.php':$conf->global->MAIN_MENUFRONT_STANDARD):$conf->global->MAIN_MENUFRONT_STANDARD_FORCED);
 +	$conf->standard_menu = (empty($conf->global->MAIN_MENUFRONT_STANDARD_FORCED) ? (empty($conf->global->MAIN_MENUFRONT_STANDARD) ? 'eldy_menu.php' : $conf->global->MAIN_MENUFRONT_STANDARD) : $conf->global->MAIN_MENUFRONT_STANDARD_FORCED);
  }
  
  // Load the menu manager (only if not already done)
  $file_menu = $conf->standard_menu;
- if (GETPOST('menu')) $file_menu = GETPOST('menu'); // example: menu=eldy_menu.php
+ if (GETPOST('menu', 'aZ09')) $file_menu = GETPOST('menu', 'aZ09');     // example: menu=eldy_menu.php
 -if (! class_exists('MenuManager'))
 +if (!class_exists('MenuManager'))
  {
 -	$menufound=0;
 -	$dirmenus=array_merge(array("/core/menus/"), (array) $conf->modules_parts['menus']);
 -	foreach($dirmenus as $dirmenu)
 +	$menufound = 0;
 +	$dirmenus = array_merge(array("/core/menus/"), (array) $conf->modules_parts['menus']);
 +	foreach ($dirmenus as $dirmenu)
  	{
 -		$menufound=dol_include_once($dirmenu."standard/".$file_menu);
 +		$menufound = dol_include_once($dirmenu."standard/".$file_menu);
  		if ($menufound) break;
  	}
 -	if (! $menufound)	// If failed to include, we try with standard
 +	if (!$menufound)	// If failed to include, we try with standard
  	{
  		dol_syslog("You define a menu manager '".$file_menu."' that can not be loaded.", LOG_WARNING);
 -		$file_menu='eldy_menu.php';
 +		$file_menu = 'eldy_menu.php';
  		include_once DOL_DOCUMENT_ROOT."/core/menus/standard/".$file_menu;
  	}
  }
 -$menumanager = new MenuManager($db, empty($user->socid)?0:1);
 -$menumanager->loadMenu('all', 'all');	// Load this->tabMenu with sql menu entries
 +$menumanager = new MenuManager($db, empty($user->socid) ? 0 : 1);
 +$menumanager->loadMenu('all', 'all'); // Load this->tabMenu with sql menu entries
  //var_dump($menumanager);exit;
  $menumanager->showmenu('jmobile');
  
  print '</body>';
  

Vulnerable code:  if (GETPOST('menu')) $file_menu = GETPOST('menu'); // example: menu=eldy_menu.php
Fixed code:  if (GETPOST('menu', 'aZ09')) $file_menu = GETPOST('menu', 'aZ09');     // example: menu=eldy_menu.php