CVE-2024-25410 (PHP, published 2024-02-26T16:27Z)
Description: value: flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/flusity/flusity-CMS
Files changed:
core/tools/actions/update_setting.php
Commit message: Update update_setting.php

Signed-off-by: Darius Jakaitis <105962203+flusity@users.noreply.github.com>

Vulnerable code:
require_once $_SERVER['DOCUMENT_ROOT'] . '/security/config.php';
 $db = getDBConnection($config);
if (isset($_POST['site_title'], $_POST['meta_description'], $_POST['footer_text'], $_POST['pretty_url'], $_POST['bilingualism'], $_POST['language'],
 $_POST['posts_per_page'], $_POST['registration_enabled'], $_POST['session_lifetime'], $_POST['default_keywords'])) { 
    $target_dir = ROOT_PATH. "/uploads/";
        $unique_code = bin2hex(random_bytes(8));
        $new_filename = $filename_parts['filename'] . '_' . $unique_code . '.' . $filename_parts['extension'];
        $target_file = $target_dir . basename($new_filename);
        $brand_icone = $new_filename; // Use the new filename
  
        if (!in_array($uploaded_file['type'], $allowed_file_types)) {
            $_SESSION['error_message'] = t("Invalid file type.");
           
        } 
        if ($uploaded_file['size'] > $max_file_size) {
           
        } 

        if (move_uploaded_file($uploaded_file["tmp_name"], $target_file)) {
            $file_url = $_SERVER['REQUEST_SCHEME'] . "://" . $_SERVER['HTTP_HOST'] . "/uploads/" . $new_filename;
            saveFileToDatabase($db, $prefix, $new_filename, $file_url);
            $_SESSION['success_message'] = "File" ." ". basename($uploaded_file["name"]) . " " .t("file uploaded successfully.");
            $_SESSION['error_message'] = t("Error loading file.");
         
?>

Fixed code:
$db = getDBConnection($config);
if (isset($_POST['site_title'], $_POST['meta_description'], $_POST['footer_text'], $_POST['pretty_url'], $_POST['bilingualism'], $_POST['language'], $_POST['posts_per_page'], $_POST['registration_enabled'], $_POST['session_lifetime'], $_POST['default_keywords'])) {
    $allowed_file_extensions = ['png', 'jpeg', 'jpg', 'gif']; // Pridėtas leidžiamų plėtinių sąrašas
    $target_dir = ROOT_PATH . "/uploads/";
        $file_extension = strtolower($filename_parts['extension']); // Paverčiama mažosiomis raidėmis, kad būtų lengviau palyginti
        if (!in_array($uploaded_file['type'], $allowed_file_types) || !in_array($file_extension, $allowed_file_extensions)) {
            $_SESSION['error_message'] = t("Invalid file type or extension.");
        } elseif ($uploaded_file['size'] > $max_file_size) {
            $unique_code = bin2hex(random_bytes(8));
            $new_filename = $filename_parts['filename'] . '_' . $unique_code . '.' . $file_extension;
            $target_file = $target_dir . basename($new_filename);
            $brand_icone = $new_filename; // Use the new filename

            if (move_uploaded_file($uploaded_file["tmp_name"], $target_file)) {
                $file_url = $_SERVER['REQUEST_SCHEME'] . "://" . $_SERVER['HTTP_HOST'] . "/uploads/" . $new_filename;
                saveFileToDatabase($db, $prefix, $new_filename, $file_url);
                $_SESSION['success_message'] = "File " . basename($uploaded_file["name"]) . " " . t("file uploaded successfully.");
            } else {
                $_SESSION['error_message'] = t("Error loading file.");
            }

?>