CVE-2017-15053 (PHP, published 2017-11-27T19:29Z)
Description: value: TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerability, an authenticated attacker must have the manager rights on the application, then tamper with the requests sent directly, for example by changing the "id" parameter when invoking "delete_role" on roles.queries.php.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/nilsteampassnet/TeamPass
Files changed:
changelog.md
includes/css/passman.css
index.php
install/install.queries.php
install/upgrade_run_2.1.27.php
items.load.php
items.php
roles.load.php
roles.php
sources/import.queries.php
sources/roles.queries.php
Commit message: 2.1.27

Added filter in Roles page
Improve truncating title in list of items


Vulnerable code:
min-width: 150px;
            ', ($session_user_id !== null && empty($session_user_id) === false) ? '<i class="fa fa-users"></i>&nbsp;'.$_SESSION['nb_users_online'].'&nbsp;'.$LANG['users_online'].'&nbsp;|&nbsp;<i class="fa fa-hourglass-end"></i>&nbsp;'.$LANG['index_expiration_in'].'&nbsp;<div style="display:inline;" id="countdown"></div>' : '', '
                            `id` int(12) NOT null AUTO_INCREMENT,
// alter table misc to add an index
mysqli_query(
    $db_link,
    "ALTER TABLE `".$pre."misc` ADD `id` INT(12) NOT NULL AUTO_INCREMENT FIRST, ADD PRIMARY KEY (`id`)"
);
\$SETTINGS = array (" . $config_text . "            
    $("#div_formulaire_edition_item_info").html("<?php echo "<i class='fa fa-cog fa-spin fa-lg'></i>&nbsp;".addslashes($LANG['please_wait'])."..."; ?>").show();
                        $("#fileclass"+data.id).text($('#edit_label').val());
            $('#edit_show_error').html("<?php echo addslashes($LANG['error_complex_not_enought']); ?>").show();
            $("#div_formulaire_edition_item_info").addClass("hidden").html("");
        $("#div_formulaire_edition_item_info").addClass("hidden").html("");
        $("#div_formulaire_edition_item ~ .ui-dialog-buttonpane").find("button:contains('<?php echo addslashes($LANG['save_button']); ?>')").prop("disabled", false);
                <table width="100%" id="item_details_table">';
                    <td valign="top" class="td_title" colspan="2">
                        <div id="id_label" style="display:inline; margin:4px 0px 0px 120px; "></div>
                    <td>
                    <td>
                    <td>
                    <td>
                    <td>
                    <td>
                    <td>
                    <td>
                    <tr>
                        <td valign="top" class="td_title">&nbsp;<i class="fa fa-angle-right"></i>&nbsp;'.$LANG['kbs'].' :</td>
                        <td>
                            <div id="id_kbs" style="display:inline;"></div><input type="hidden" id="hid_kbs" />
                        </td>
                    </tr>';
                    <tr class="tr_fields hidden" id="tr_catfield_'.$elem[0].'">
                        <td valign="top" class="td_title">&nbsp;<i class="fa fa-angle-right"></i>&nbsp;'.$elem[1].' :</td>
                        <td></td>
                    </tr>';
                        <td>';
    <div style="display:none; padding:5px;" id="div_formulaire_edition_item_info" class="ui-state-default ui-corner-all"></div>


    $("#roles_next, #roles_previous").hide();
            start    : start
            if (data.new_table != "") {
                if (data.next < data.all) {
                    $("#roles_next").show();
                    $("#roles_previous").show();
        <i class="fa fa-plus"></i>
        <i class="fa fa-refresh"></i>
        <span class="fa fa-arrow-left" style="display:none;cursor:pointer" id="roles_previous" onclick="refresh_roles_matrix(\'previous\')"></span>&nbsp;
        <span class="fa fa-arrow-right" style="display:none;cursor:pointer" id="roles_next" onclick="refresh_roles_matrix(\'next\')"></span>
        
            $tab_fonctions = array();
            if (count($arrUserRoles) == 0 || $_SESSION['is_admin'] == 1) {
                $where = "";
            } else {
                $where = " WHERE id IN (".implode(',', $arrUserRoles).")";
                $next = $start + $display_nb;
                "previous" => $previous

Fixed code:
 Added filter in Roles
min-width: 120px;
.normal {
  font: normal; "Lucida Grande";
  color: #464646;
}

}

.no-border {
  border: none;
  border-collapse: collapse;
$session_nb_users_online =        $superGlobal->get("nb_users_online", "SESSION");
            ', ($session_user_id !== null && empty($session_user_id) === false) ? '<i class="fa fa-users"></i>&nbsp;'.$session_nb_users_online.'&nbsp;'.$LANG['users_online'].'&nbsp;|&nbsp;<i class="fa fa-hourglass-end"></i>&nbsp;'.$LANG['index_expiration_in'].'&nbsp;<div style="display:inline;" id="countdown"></div>' : '', '
                            `increment_id` int(12) NOT null AUTO_INCREMENT,
// alter table MISC - rename ID is exists
$result = mysqli_query("SHOW COLUMNS FROM `misc` LIKE 'id'");
if (mysqli_num_rows($result) !== 0) {
    // Change name of field
    mysqli_query($db_link, "ALTER TABLE `".$pre."misc` CHANGE `id` `increment_id` INT(12) NOT NULL");
} else {
    // alter table misc to add an index
    $res = addColumnIfNotExist(
        $pre."misc",
        "increment_id",
        "INT(12) NOT NULL AUTO_INCREMENT FIRST, ADD PRIMARY KEY (`id`)"
    );
}
\$SETTINGS = array (" . $config_text . "
    $("#div_formulaire_edition_item_info")
        .html("<?php echo "<i class='fa fa-cog fa-spin fa-lg'></i>&nbsp;".addslashes($LANG['please_wait'])."..."; ?>")
        .removeClass("hidden");
                        $("#fileclass"+data.id).html('<div class="truncate">' + $('#edit_label').val() + '</div>');
            $('#edit_show_error')
                .html("<?php echo addslashes($LANG['error_complex_not_enought']); ?>")
                .show();
            $("#div_formulaire_edition_item_info")
                .addClass("hidden")
                .html("");
        $("#div_formulaire_edition_item_info")
            .addClass("hidden")
            .html("");
        $("#div_formulaire_edition_item ~ .ui-dialog-buttonpane")
            .find("button:contains('<?php echo addslashes($LANG['save_button']); ?>')")
            .prop("disabled", false);

                            // set indicator if item has change proposal
                            $("#item_extra_info").prepend('<i class="fa fa-lightbulb-o fa-sm mi-yellow tip" title="<?php echo addslashes($LANG['item_has_change_proposal']); ?>" onclick=""></i>&nbsp;');
                            $(".tip").tooltipster({multiple: true});

                <table width="100%" class="no-border" id="item_details_table">';
                    <td valign="top" class="td_title" width="120px" style="background-color:rgba(178, 178, 178, 0.13);">
                    </td>
                    <td valign="middle" style="background-color:rgba(178, 178, 178, 0.13);">
                        <span id="id_label" style="font-weight:bold;"></span>
                    </td>
                    <td style="background-color:rgba(178, 178, 178, 0.13);">
                    <td colspan="2">
                    <td colspan="2">
                    <td colspan="2">
                    <td colspan="2">
                    <td colspan="2">
                    <td colspan="2">
                    <td colspan="2">
                    <td colspan="2">
                <tr>
                    <td valign="top" class="td_title">&nbsp;<i class="fa fa-angle-right"></i>&nbsp;'.$LANG['kbs'].' :</td>
                    <td colspan="2">
                        <div id="id_kbs" style="display:inline;"></div><input type="hidden" id="hid_kbs" />
                    </td>
                </tr>';
                <tr class="tr_fields hidden" id="tr_catfield_'.$elem[0].'">
                    <td valign="top" class="td_title">&nbsp;<i class="fa fa-angle-right"></i>&nbsp;'.$elem[1].' :</td>
                    <td colspan="2"></td>
                </tr>';
                        <td colspan="2">';
    <div style="padding:5px;" id="div_formulaire_edition_item_info" class="ui-state-default ui-corner-all hidden"></div>
    $(".roles_next, .roles_previous").hide();
            start   : start,
            filter  : $("#filter_roles").val()
            if (data.new_table !== "") {
                if (data.next < data.all && data.next >= 9) {
                    $(".roles_next").show();
                    $(".roles_previous").show();

                $("#filter_roles").val("");

            // Prepare autocomplete for filterbox
            //Prepare autocomplete for filter
            $("#filter_roles")
                .autocomplete({
                    source: data.list_of_roles,
                    focus: function() {
                        // prevent value inserted on focus
                        return false;
                    }
                }
            );

        <span class="fa fa-plus"></span>
    &nbsp;
    <span class="normal"><input id="filter_roles" class="ui-widget ui-corner-all" type="text" value="" placeholder="No filter" /></span>
        <span class="fa fa-refresh"></span>
    </button>
    &nbsp;
    <button onclick="refresh_roles_matrix(\'previous\')" class="button roles_previous" style="font-size:16px;">
        <span class="fa fa-arrow-left"></span>
    </button>
    <button onclick="refresh_roles_matrix(\'next\')" class="button roles_next" style="font-size:16px;">
        <span class="fa fa-arrow-right"></span>
        <button onclick="refresh_roles_matrix(\'previous\')" class="button roles_previous" style="font-size:16px;">
            <span class="fa fa-arrow-left"></span>
        </button>
        <button onclick="refresh_roles_matrix(\'next\')" class="button roles_next" style="font-size:16px;">
            <span class="fa fa-arrow-right"></span>
        </button>

            $post_filter = filter_input(INPUT_POST, 'filter', FILTER_SANITIZE_STRING);
            $arrRolesTitle = array();
            $where = "";

            // Should we filter on role names
            if (empty($post_filter) === false) {
                $where = " WHERE title LIKE '".$post_filter."%'";
            }
            if (count($arrUserRoles) >= 0 && $_SESSION['is_admin'] !== "1") {
                if (empty($where) === false) {
                    $where = " WHERE id IN (".implode(',', $arrUserRoles).")";
                } else {
                    $where .= " AND id IN (".implode(',', $arrUserRoles).")";
                }
                $next = $start + $display_nb + 1;
                    array_push($arrRolesTitle, $record['title']);
                "previous" => $previous,
                "list_of_roles" => $arrRolesTitle