CVE-2023-1463 (PHP, published 2023-03-17T12:15Z)
Description: value: Authorization Bypass Through User-Controlled Key in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/nilsteampassnet/teampass
Files changed:
error.php
includes/core/load.js.php
includes/core/logout.php
install/css/install.css
install/upgrade.php
Commit message: 3.0.0.23

Fix for identified CWE-285: Improper Authorization


Vulnerable code:
                    For security reason, you have been disconnected. Click to <a href="./includes/core/logout.php?user_id=" + <?php echo isset($_SESSION['user_id']) === true ? $_SESSION['user_id'] : ''; ?>>log in</a>.
                window.location.href = "./includes/core/logout.php?user_id=" + <?php echo $_SESSION['user_id']; ?>
                    window.location.href = "./includes/core/logout.php?user_id=" + <?php echo $_SESSION['user_id']; ?>
} elseif (isset($get['user_id']) === true && empty($get['user_id']) === false) {
    $user_id = $get['user_id'];
        'id=%i',
        $user_id

.center-screen {
	position:absolute;
	top:50%;
	left: 50%;
	margin-right: -50%;
	transform: translate(-50%, -50%);
}
                    <div class="card-body">';

Fixed code:
                    For security reason, you have been disconnected. Click to <a href="./includes/core/logout.php?token=" + <?php echo isset($_SESSION['key']) === true ? $_SESSION['key'] : ''; ?>>log in</a>.
                window.location.href = "./includes/core/logout.php?token=<?php echo $_SESSION['key']; ?>";
                    window.location.href = "./includes/core/logout.php?token=" + <?php echo $_SESSION['key']; ?>
} elseif (isset($get['token']) === true && empty($get['token']) === false) {
    $user_token = $get['token'];
    $user_token = '';
        'id=%i || key_tempo=%s',
        $user_id,
        $user_token
                    <div class="card-body">
                        <!--<div class="form-group">
                            <label>Host</label>
                            <input type="text" class="form-control" name="db_host" id="db_host" class="ui-widget" value="'.DB_HOST.'">
                        </div>
                        
                        <div class="form-group">
                            <label>Database name</label>
                            <input type="text" class="form-control" name="db_name" id="db_name" class="ui-widget" value="'.DB_NAME.'">
                        </div>
                        
                        <div class="form-group">
                            <label>Login</label>
                            <input type="text" class="form-control" name="db_user" id="db_user" class="ui-widget" value="'.DB_USER.'">
                        </div>
                        
                        <div class="form-group">
                            <label>Password</label>
                            <input type="text" class="form-control" name="db_pw" id="db_pw" class="ui-widget" value="'.$visible_pwd.'">
                        </div>
                        
                        <div class="form-group">
                            <label>Prefix</label>
                            <input type="text" class="form-control" name="db_prefix" id="db_prefix" class="ui-widget" value="'.DB_PREFIX.'">
                        </div>
                        
                        <div class="form-group">
                            <label>Port</label>
                            <input type="text" class="form-control" name="db_port" id="db_port" class="ui-widget" value="'.DB_PORT.'">
                        </div>-->';