CVE-2024-24572 (PHP, published 2024-01-31T23:15Z)
Description: value: facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was unsafely called inside an extract() function in admin-logs.php. The PHP file fm-init.php prevents arbitrary manipulation of $_SESSION via the GET/POST parameters. However, it does not prevent manipulation of any other sensitive variables such as $search_sql. Knowing this, an authenticated user with privileges to view site logs can manipulate the search_sql
variable by appending a GET parameter search_sql in the URL. The information above means that the checks and SQL injection prevention attempts were rendered unusable.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/WillyXJ/facileManager
Files changed:
server/fm-includes/version.php
server/fm-modules/facileManager/change.log
server/fm-modules/facileManager/classes/class_logins.php
server/fm-modules/facileManager/classes/class_users.php
server/fm-modules/facileManager/functions.php
server/fm-modules/facileManager/pages/admin-logs.php
Commit message: fM - #599 - Multiple security fixes


Vulnerable code:
$fm_version = '4.5.0';
			if (is_array($fmdb->last_result) && $fmdb->last_result[0]->user_login == $user_login) {
		if ((!currentUserCan('manage_users') && $_SESSION['user']['id'] != $post['user_id']) || isset($post['user_login'])) {
			return _('You do not have permission to make these changes.');
		$data = str_replace('--', '-', $data);
$search_sql = $list = $log_search_query = $log_search_date_b = $log_search_date_e = null;
$list = null;

Fixed code:
$fm_version = '4.5.1';
4.5.1 (2024-01-30)
==================
* Server - [security] Fixed authenticated variable manipulation leading to SQL Injection. (Issue #599)
* Server - [security] Fixed privilege escalation via mass assignment. (Issue #599)
* Server - [security] Fixed systemic cross-site scripting (XSS). (Issue #599)

			if (isset($fmdb->last_result) && is_array($fmdb->last_result) && $fmdb->last_result[0]->user_login == $user_login) {
		if ((!currentUserCan('manage_users') && ($_SESSION['user']['id'] != $post['user_id'] || isset($post['user_caps']))) 
			|| ($_SESSION['user']['id'] != $post['user_id'] && $post['user_id'] == getDefaultAdminID()) 
			|| isset($post['user_login'])
			|| (isset($post['user_caps']) && $_SESSION['user']['id'] == $post['user_id'] && $_SESSION['user']['id'] == getDefaultAdminID())) {
				return _('You do not have permission to make these changes.');
		$data = str_replace($replace . $replace, $replace, $data);
			$data = htmlspecialchars(strip_tags($data), ENT_NOQUOTES);
$search_sql = null;