CVE-2023-0790 (PHP, published 2023-02-12T14:15Z)
Description: value: Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.


Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-248 \u2014 Uncaught Exception
An exception is thrown from a function, but it is not caught.
Repository: https://github.com/thorsten/phpmyfaq
Files changed:
phpmyfaq/admin/user.php
Commit message: fix: added missing check on email address


Vulnerable code:
            $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_UNSAFE_RAW, '');
            $userData['email'] = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL, '');
            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW, '');
            $user = new User($faqConfig);
            $user->getUserById($userId, true);
            $stats = $user->getStatus();
            // set new password an send email if user is switched to active
            if ($stats == 'blocked' && $userStatus == 'active') {
                if (!$user->activateUser()) {
                    $userStatus = 'invalid_status';
            }

            // Set super-admin flag
            $user->setSuperAdmin($isSuperAdmin);
            if (
                !$user->userdata->set(array_keys($userData), array_values($userData)) ||
                !$user->setStatus($userStatus)
            ) {
                $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_msg_mysqlerr']);
            } else {
                $message .= sprintf(
                    '<p class="alert alert-success">%s <strong>%s</strong> %s</p>',
                    $PMF_LANG['ad_msg_savedsuc_1'],
                    Strings::htmlentities($user->getLogin(), ENT_QUOTES),
                    $PMF_LANG['ad_msg_savedsuc_2']
                );
                $message .= '<script>updateUser(' . $userId . ');</script>';

Fixed code:
            $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_UNSAFE_RAW);
            $userData['email'] = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW);
            // Sanity check
            if (is_null($userData['email'])) {
                $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['err_noMailAdress']);
            } else {
                $user = new User($faqConfig);
                $user->getUserById($userId, true);
                $stats = $user->getStatus();
                // set new password an send email if user is switched to active
                if ($stats == 'blocked' && $userStatus == 'active') {
                    if (!$user->activateUser()) {
                        $userStatus = 'invalid_status';
                    }
                // Set super-admin flag
                $user->setSuperAdmin($isSuperAdmin);

                if (
                    !$user->userdata->set(array_keys($userData), array_values($userData)) ||
                    !$user->setStatus($userStatus)
                ) {
                    $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_msg_mysqlerr']);
                } else {
                    $message .= sprintf(
                        '<p class="alert alert-success">%s <strong>%s</strong> %s</p>',
                        $PMF_LANG['ad_msg_savedsuc_1'],
                        Strings::htmlentities($user->getLogin(), ENT_QUOTES),
                        $PMF_LANG['ad_msg_savedsuc_2']
                    );
                    $message .= '<script>updateUser(' . $userId . ');</script>';
                }