CVE-2022-44216 (PHP, published 2023-02-20T20:15Z)
Description: value: Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without knowing victim's original password.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Repository: https://github.com/gnuboard/gnuboard5
Files changed:
bbs/password_reset_update.php
mobile/skin/member/basic/password_reset.skin.php
plugin/inicert/ini_find_result.php
plugin/kcpcert/find_kcpcert_result.php
plugin/lgxpay/find_AuthOnlyRes.php
plugin/okname/find_hpcert2.php
plugin/okname/find_ipin2.php
skin/member/basic/password_reset.skin.php
theme/basic/mobile/skin/member/basic/password_reset.skin.php
theme/basic/skin/member/basic/password_reset.skin.php
Commit message: [G5-80] 본인인증 비밀번호 찾기 후 비밀번호 변경 관련 수정


Vulnerable code:
if($w == '')
    $mb_id = isset($_POST['mb_id']) ? trim($_POST['mb_id']) : '';
else
    alert('잘못된 접근입니다', G5_URL);
if(!$mb_id)
    alert('회원아이디 값이 없습니다. 올바른 방법으로 이용해 주십시오.');
if ($w == '' && !$mb_password)
alert('비밀번호가 넘어오지 않았습니다.');
if($w == '' && $mb_password != $mb_password_re)
alert('비밀번호가 일치하지 않습니다.');
$sql_password = "";
if ($mb_password)
    $sql_password = "mb_password = '".get_encrypt_string($mb_password)."' ";
sql_query("update {$g5['member_table']} set {$sql_password} where mb_id = '{$mb_id}'");
                <input type="text" name="mb_id" id="mb_id" value="<?php echo $_POST['mb_id']; ?>" required class="required frm_input full_input" size="30" placeholder="아이디" readonly>

                <input type="text" name="mb_id" id="mb_id" value="<?php echo $_POST['mb_id']; ?>" required class="required frm_input full_input" size="30" placeholder="아이디" readonly>
                <input type="text" name="mb_id" id="mb_id" value="<?php echo $_POST['mb_id']; ?>" required class="required frm_input full_input" size="30" placeholder="아이디" readonly>
                <input type="text" name="mb_id" id="mb_id" value="<?php echo $_POST['mb_id']; ?>" required class="required frm_input full_input" size="30" placeholder="아이디" readonly>

Fixed code:
$mb_id = isset($_SESSION['ss_cert_mb_id']) ? trim(get_session('ss_cert_mb_id')) : '';
$mb_dupinfo = isset($_SESSION['ss_cert_dupinfo']) ? trim(get_session('ss_cert_dupinfo')) : '';
if(!$mb_id) alert('회원아이디 값이 없습니다. 올바른 방법으로 이용해 주십시오.', G5_URL);

if(!$mb_dupinfo) alert('잘못된 접근입니다.', G5_URL);

$mb_check = sql_fetch("select * from {$g5['member_table']} where mb_id = '{$mb_id}' AND mb_dupinfo = '{$mb_dupinfo}'");

if(!$mb_check) alert('잘못된 접근입니다.', G5_URL);
if (!$mb_password)
    alert('비밀번호가 넘어오지 않았습니다.');
if ($mb_password != $mb_password_re)
    alert('비밀번호가 일치하지 않습니다.');

$sql_password = "mb_password = '".get_encrypt_string($mb_password)."' ";
sql_query("update {$g5['member_table']} set {$sql_password} where mb_id = '{$mb_id}' AND mb_dupinfo = '{$mb_dupinfo}'");
set_session('ss_cert_mb_id', '');
set_session('ss_cert_dupinfo', '');
                <br>
                <b>회원 아이디 : <?php echo $_POST['mb_id']; ?></b>

        $md5_cert_no = md5($cert_no);
        $hash_data   = md5($user_name.$cert_type.$birth_day.$phone_no.$md5_cert_no);

        // 성인인증결과
        $adult_day = date("Ymd", strtotime("-19 years", G5_SERVER_TIME));
        $adult = ((int)$birth_day <= (int)$adult_day) ? 1 : 0;

        set_session("ss_cert_type",    $cert_type);
        set_session("ss_cert_no",      $md5_cert_no);
        set_session("ss_cert_hash",    $hash_data);
        set_session("ss_cert_adult",   $adult);
        set_session("ss_cert_birth",   $birth_day);
        //set_session("ss_cert_sex",     ($sex_code=="01"?"M":"F")); // 이니시스 간편인증은 성별정보 리턴 없음
        set_session('ss_cert_dupinfo', $mb_dupinfo);
        set_session('ss_cert_mb_id', $row['mb_id']);
        }else{
            $mb_dupinfo = $md5_ci;
        
        $md5_cert_no = md5($cert_no);
        $hash_data   = md5($user_name.$cert_type.$birth_day.$phone_no.$md5_cert_no);
        
        // 성인인증결과
        $adult_day = date("Ymd", strtotime("-19 years", G5_SERVER_TIME));
        $adult = ((int)$birth_day <= (int)$adult_day) ? 1 : 0;
        
        set_session("ss_cert_type",    $cert_type);
        set_session("ss_cert_no",      $md5_cert_no);
        set_session("ss_cert_hash",    $hash_data);
        set_session("ss_cert_adult",   $adult);
        set_session("ss_cert_birth",   $birth_day);
        set_session("ss_cert_sex",     ($sex_code=="01"?"M":"F")); // 이니시스 간편인증은 성별정보 리턴 없음
        set_session('ss_cert_dupinfo', $mb_dupinfo);
        set_session('ss_cert_mb_id', $row['mb_id']);
        }else{
            $mb_dupinfo = $md5_ci;
        
        $md5_cert_no = md5($cert_no);
        $hash_data   = md5($user_name.$cert_type.$birth_day.$phone_no.$md5_cert_no);
        
        // 성인인증결과
        $adult_day = date("Ymd", strtotime("-19 years", G5_SERVER_TIME));
        $adult = ((int)$birth_day <= (int)$adult_day) ? 1 : 0;
        
        set_session("ss_cert_type",    $cert_type);
        set_session("ss_cert_no",      $md5_cert_no);
        set_session("ss_cert_hash",    $hash_data);
        set_session("ss_cert_adult",   $adult);
        set_session("ss_cert_birth",   $birth_day);
        set_session("ss_cert_sex",     $mb_sex); // 이니시스 간편인증은 성별정보 리턴 없음
        set_session('ss_cert_dupinfo', $mb_dupinfo);
        set_session('ss_cert_mb_id', $row['mb_id']);
}else{
    $mb_dupinfo = $md5_ci;
$md5_cert_no = md5($cert_no);
$hash_data   = md5($user_name.$cert_type.$birth_day.$phone_no.$md5_cert_no);

// 성인인증결과
$adult_day = date("Ymd", strtotime("-19 years", G5_SERVER_TIME));
$adult = ((int)$birth_day <= (int)$adult_day) ? 1 : 0;

set_session("ss_cert_type",    $cert_type);
set_session("ss_cert_no",      $md5_cert_no);
set_session("ss_cert_hash",    $hash_data);
set_session("ss_cert_adult",   $adult);
set_session("ss_cert_birth",   $birth_day);
set_session('ss_cert_sex',     ($field[9] == 1 ? 'M' : 'F'));
set_session('ss_cert_dupinfo', $mb_dupinfo);
set_session('ss_cert_mb_id', $row['mb_id']);

}else{
    $mb_dupinfo = $md5_ci;

$md5_cert_no = md5($cert_no);
$hash_data   = md5($user_name.$cert_type.$birth_day.$phone_no.$md5_cert_no);

// 성인인증결과
$adult_day = date("Ymd", strtotime("-19 years", G5_SERVER_TIME));
$adult = ((int)$birth_day <= (int)$adult_day) ? 1 : 0;

set_session("ss_cert_type",    $cert_type);
set_session("ss_cert_no",      $md5_cert_no);
set_session("ss_cert_hash",    $hash_data);
set_session("ss_cert_adult",   $adult);
set_session("ss_cert_birth",   $birth_day);
set_session('ss_cert_sex',     ($field[9] == 1 ? 'M' : 'F'));
set_session('ss_cert_dupinfo', $mb_dupinfo);
set_session('ss_cert_mb_id', $row['mb_id']);

                <br>
                <b>회원 아이디 : <?php echo $_POST['mb_id']; ?></b>
                <br>
                <b>회원 아이디 : <?php echo $_POST['mb_id']; ?></b>
                <br>
                <b>회원 아이디 : <?php echo $_POST['mb_id']; ?></b>