CVE-2019-25099 (PHP, published 2023-01-06T13:15Z)
Description: value: A vulnerability classified as critical was found in Arthmoor QSF-Portal. This vulnerability affects unknown code of the file index.php. The manipulation of the argument a leads to path traversal. The patch is identified as ea4f61e23ecb83247d174bc2e2cbab521c751a7d. It is recommended to apply a patch to fix this issue. VDB-217558 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/Arthmoor/QSF-Portal
Files changed:
docs/ChangeLog.txt
index.php
Commit message: Tweaked the initial module selection code to block out potential attacks and notify administrators when this happens.


Vulnerable code:
} elseif( !file_exists( 'func/' . $_GET['a'] . '.php' ) ) {
	$module = 'main';

	if( $_GET['a'] != 'forum_rules' && $_GET['a'] != 'upload_rules' ) {
		$qstring = $_SERVER['REQUEST_URI'];
		$terms_module = $_GET['a'];
	$module = $_GET['a'];
}
if( strstr( $module, '/' ) || strstr( $module, '\\' ) ) {
	header( 'HTTP/1.0 403 Forbidden' );
	exit( 'You have been banned from this site.' );
session_start();


Fixed code:
* Tweaked the initial module selection code to block out potential attacks and notify administrators when this happens.
function log_hostile_action( $set, $qstring )
{
	if( isset( $set['admin_email'] ) ) {
		$https = isset( $_SERVER['HTTPS'] ) ? 'https://' : 'http://';

		$headers = "From: Your QSF Portal Site <{$set['admin_email']}>\r\n" . "X-Mailer: PHP/" . phpversion();

		$agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? $_SERVER['HTTP_USER_AGENT'] : 'N/A';
		$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? $_SERVER['REMOTE_ADDR'] : '127.0.0.1';

		$error_report = "QSF Portal has intercepted a possible attack!\n";
		$error_report .= "The details are as follows:\n\nURL: $https" . $_SERVER['SERVER_NAME'] . $_SERVER['PHP_SELF'] . "?" . $qstring . "\n";
		$error_report .= "Querying user agent: " . $agent . "\n";
		$error_report .= "Querying IP: " . $ip . "\n\n";
		$error_report = str_replace( "&nbsp;", " ", html_entity_decode( $error_report ) );

		@mail( $set['admin_email'], "[QSF Portal] Potential Attack Intercepted", $error_report, $headers );
	}
}

session_start();

} elseif( !empty( $_GET['a'] ) ) {
	if( strstr( $_GET['a'], '/' ) || strstr( $_GET['a'], '\\' ) || strstr( $_GET['a'], '.' ) ) {
		if( isset( $_SERVER['QUERY_STRING'] ) && !empty( $_SERVER['QUERY_STRING'] ) ) {
			$qstring = $_SERVER['QUERY_STRING'];
		}

		$_SESSION = array();

		session_destroy();

		log_hostile_action( $set, $qstring );

		header( 'Clear-Site-Data: "*"' );
	} elseif( !file_exists( 'func/' . $_GET['a'] . '.php' ) ) {
		$module = 'main';

		if( $_GET['a'] != 'forum_rules' && $_GET['a'] != 'upload_rules' ) {
			$qstring = $_SERVER['REQUEST_URI'];

			$missing = true;
		} else {
			$terms_module = $_GET['a'];
		}
		$module = $_GET['a'];
	if( isset( $_SERVER['QUERY_STRING'] ) && !empty( $_SERVER['QUERY_STRING'] ) ) {
		$qstring = $_SERVER['QUERY_STRING'];
		$missing = true;
	}