CVE-2023-4381 (PHP, published 2023-08-16T12:15Z)
Description: value: Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/instantsoft/icms2
Files changed:
system/controllers/users/forms/form_password.php
system/languages/en/language.php
system/languages/ru/language.php
Commit message: New password cannot be the same as the old password

Vulnerable code:
        return array(

            'basic' => array(
                'type' => 'fieldset',
                'title' => LANG_PASSWORD,
                'childs' => array(
                    new fieldString('password', array(
                        'title' => LANG_OLD_PASS,
                        'options'=>array(
                            'min_length'=> 6,
                            'max_length'=> 72
                        ),
                        'rules' => array(
                            array('required'),
                            array(function($controller, $data, $value)use($profile){
                                if (!$user){

                            })
                        )
                    )),
                    new fieldString('password1', array(
                        'title' => LANG_NEW_PASS,
                        'is_password' => true,
                        'options'=>array(
                            'min_length'=> 6,
                            'max_length'=> 72
                        )
                    )),
                    new fieldString('password2', array(
                        'title' => LANG_RETYPE_NEW_PASS,
                        'options'=>array(
                            'min_length'=> 6,
                            'max_length'=> 72
                        )
                    ))
                )
            )
        );
    }

Fixed code:
        return [
            'basic' => [
                'type'   => 'fieldset',
                'title'  => LANG_PASSWORD,
                'childs' => [
                    new fieldString('password', [
                        'title'       => LANG_OLD_PASS,
                        'options'     => [
                            'min_length' => 6,
                            'max_length' => 72
                        ],
                        'rules' => [
                            ['required'],
                            [function ($controller, $data, $value)use ($profile) {
                                if (!$user) {
                            }]
                        ]
                    ]),
                    new fieldString('password1', [
                        'title'       => LANG_NEW_PASS,
                        'options'     => [
                            'min_length' => 6,
                            'max_length' => 72
                        ],
                        'rules' => [
                            [function ($controller, $data, $value)use ($profile) {
                                if (!$value) {
                                    return true;
                                }
                                $user = cmsCore::getModel('users')->getUserByAuth($profile['email'], $value);
                                if ($user) {
                                    return ERR_NEW_PASS_AS_OLD;
                                }

                                return true;
                            }]
                        ]
                    ]),
                    new fieldString('password2', [
                        'title'       => LANG_RETYPE_NEW_PASS,
                        'is_password' => true,
                        'options'     => [
                            'min_length' => 6,
                            'max_length' => 72
                        ]
                    ])
                ]
            ]
        ];

    }
    define('ERR_NEW_PASS_AS_OLD', 		     'The new password cannot be the same as the old password');
    define('ERR_NEW_PASS_AS_OLD', 		     'Новый пароль не может быть таким же, как старый');