CVE-2022-2921 (PHP, published 2022-08-21T04:15Z)
Description: value: Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-359 \u2014 Exposure of Private Personal Information to an Unauthorized Actor
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
Repository: https://github.com/notrinos/notrinoserp
Files changed:
admin/change_current_user_password.php
admin/create_coy.php
admin/db/users_db.inc
admin/users.php
includes/current_user.inc
Commit message: changed password hash method from md5 to bcrypt.


Vulnerable code:
		$Auth_Result = get_user_auth($_SESSION['wa_current_user']->username, md5($_POST['cur_password']));
			update_user_password($_SESSION['wa_current_user']->user, $_SESSION['wa_current_user']->username, md5($_POST['password']));
end_page();
$comp_subdirs = array('images', 'pdf_files', 'backup','js_cache', 'reporting', 'attachments');
			display_error(_('Error creating Database: ') . $conn['dbname'] . _(', Please create it manually'));
				update_admin_password($conn, md5($_POST['admpassword']));
end_page();
function get_user_auth($user_id, $password) {
	$sql = "SELECT * FROM ".TB_PREF."users WHERE user_id = ".db_escape($user_id)." AND"
		." password=".db_escape($password);
	return db_num_rows(db_query($sql, 'could not get validate user login for '.$user_id)) != 0;
				update_user_password($selected_id, $_POST['user_id'], md5($_POST['password']));
			add_user($_POST['user_id'], $_POST['real_name'], md5($_POST['password']), $_POST['phone'], $_POST['email'], $_POST['role_id'], $_POST['language'], $_POST['print_profile'], check_value('rep_popup'), $_POST['pos']);
		// in FA users table anyway to successfully log in.
			$Auth_Result = get_user_auth($loginname, md5($password));
			$hash = md5($password);

Fixed code:
		$Auth_Result = authenticate_user($_SESSION['wa_current_user']->username, $_POST['cur_password']);
			update_user_password($_SESSION['wa_current_user']->user, $_SESSION['wa_current_user']->username, password_hash($_POST['password'], PASSWORD_DEFAULT));
end_page();
$comp_subdirs = array('images', 'pdf_files', 'backup', 'js_cache', 'reporting', 'attachments');
			display_error(_('Error creating Database: ').$conn['dbname']._(', Please create it manually'));
				update_admin_password($conn, password_hash($_POST['admpassword']), PASSWORD_DEFAULT);
end_page();
function authenticate_user($user_id, $password) {
	$sql1 = "SELECT password FROM ".TB_PREF."users WHERE user_id = ".db_escape($user_id);
	$result = db_query($sql1, 'could not get user login for '.$user_id);

	if(db_num_rows($result) == 0)
		return false;

	$hash = db_fetch($result)[0];

	// The user's password hash may have been created long ago by md5 password algorithm on the old NotrinosERP versions
	if(password_verify($password, $hash) || $hash == md5($password)) {
		if(password_needs_rehash($hash, PASSWORD_DEFAULT) === true) {
			$new_hash = password_hash($password, PASSWORD_DEFAULT);
			$sql2 = "UPDATE ".TB_PREF."users SET password = ".db_escape($new_hash)." WHERE user_id = ".db_escape($user_id);
			db_query($sql2, 'could not update password hash for '.$user_id);
		}

		return true;
	}

	return false;
				update_user_password($selected_id, $_POST['user_id'], password_hash($_POST['password'], PASSWORD_DEFAULT));
			add_user($_POST['user_id'], $_POST['real_name'], password_hash($_POST['password'], PASSWORD_DEFAULT), $_POST['phone'], $_POST['email'], $_POST['role_id'], $_POST['language'], $_POST['print_profile'], check_value('rep_popup'), $_POST['pos']);
		// in NotrinosERP users table anyway to successfully log in.
			$Auth_Result = authenticate_user($loginname, $password);
			$hash = password_hash($password);