CVE-2024-31823 (PHP, published 2024-04-29T18:15Z)
Description: value: An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the removeSecondaryImage method of the Publish.php component.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap
Files changed:
application/modules/admin/controllers/advanced_settings/Languages.php
application/modules/admin/controllers/ecommerce/Publish.php
application/modules/admin/models/Orders_model.php
Commit message: Vulnerability fixes from Lion Tree


Vulnerable code:
            $phpFileInclude .= '$lang[\'' . htmlentities($_POST['php_keys'][$i]) . '\'] = \'' . $php_value . '\';' . "\n";
            $jsFileInclude .= htmlentities($_POST['js_keys'][$i]) . ':' . '"' . htmlentities($_POST['js_values'][$i]) . '",' . "\n";
        $files = rreadDir('application' . DIRECTORY_SEPARATOR . 'language' . DIRECTORY_SEPARATOR . '' . $_GET['editLang'] . DIRECTORY_SEPARATOR);

    public function removeSecondaryImage()
    {
            $img = '.' . DIRECTORY_SEPARATOR . 'attachments' . DIRECTORY_SEPARATOR . 'shop_images' . DIRECTORY_SEPARATOR . '' . $_POST['folder'] . DIRECTORY_SEPARATOR . $_POST['image'];
            unlink($img);

                    if (!$this->db->query('UPDATE products SET quantity=quantity' . $operator . $product['product_quantity'] . ' WHERE id = ' . $product['product_info']['id'])) {
                    if (!$this->db->query('UPDATE products SET procurement=procurement' . $operator_pro . $product['product_quantity'] . ' WHERE id = ' . $product['product_info']['id'])) {

Fixed code:
            $phpFileInclude .= '$lang[\'' . htmlentities(addslashes($_POST['php_keys'][$i])) . '\'] = \'' . $php_value . '\';' . "\n";
            $jsFileInclude .= htmlentities(addslashes($_POST['js_keys'][$i])) . ':' . '"' . htmlentities(addslashes($_POST['js_values'][$i])) . '",' . "\n";
        if(!ctype_alnum($_GET['editLang'])) {
            redirect('admin/languages');
        }

        $dir = 'application' . DIRECTORY_SEPARATOR . 'language' . DIRECTORY_SEPARATOR . '' . $_GET['editLang'] . DIRECTORY_SEPARATOR;
        if(!is_dir(rtrim($dir, DIRECTORY_SEPARATOR))) {
            redirect('admin/languages');
        }

        $files = rreadDir($dir);

                    $file_content = file_get_contents($fileLang);
                    $tokens = token_get_all($file_content);
                    foreach ($tokens as $tokenK => $token) {
                        if ($token[0] == T_VARIABLE) {
                            if($token[1] != '$lang') {
                                throw new \Exception('Invalid variable name in file ' . $fileLang . ' on line ' . $token[2] . '');
                            }
                        }
                        unset($tokens[$tokenK]);
                    }

    public function removeSecondaryImage() {
            $basePath = realpath('.' . DIRECTORY_SEPARATOR . 'attachments' . DIRECTORY_SEPARATOR . 'shop_images' . DIRECTORY_SEPARATOR);
    
            $folder = realpath($basePath . DIRECTORY_SEPARATOR . $_POST['folder']);
            $image = $_POST['image'];
    
            if ($folder !== false && strpos($folder, $basePath) === 0 && is_file($folder . DIRECTORY_SEPARATOR . $image)) {
                unlink($folder . DIRECTORY_SEPARATOR . $image);
            }
                if (!is_numeric($product['product_quantity']) || (int)$product['product_info']['id'] < 1) {
                    continue;
                }

                    if (!$this->db->query('UPDATE products SET quantity=quantity' . $operator . $product['product_quantity'] . ' WHERE id = ' . (int)$product['product_info']['id'])) {
                    if (!$this->db->query('UPDATE products SET procurement=procurement' . $operator_pro . $product['product_quantity'] . ' WHERE id = ' . (int)$product['product_info']['id'])) {