CVE-2023-0455 (PHP, published 2023-01-26T22:15Z)
Description: value: Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/unilogies/bumsys
Files changed:
core/config.php
core/functions.php
Commit message: Update Security


Vulnerable code:
 * Define allowed mime type.
$_SETTINGS["VALID_IMAGE_TYPE_FOR_UPLOAD"] = array("jpeg", "jpg", "png");
$_SETTINGS["VALID_DOCUMENT_TYPE_FOR_UPLOAD"] = array("pdf", "msword", "vnd.openxmlformats-officedocument.wordprocessingml.document", "vnd.ms-excel", "vnd.openxmlformats-officedocument.spreadsheetml.sheet");

$_SETTINGS["VALID_AUDIO_TYPE_FOR_UPLOAD"] = array("mpeg", "ogg", "opus", "aac", "wav", "webm");
function easyUpload( 
    $type = strtolower($type);
    $extensionName = strtolower(explode("/", $file["type"])[1]);
    $validExtensionForUpload = [];
        case "image":       $validExtensionForUpload = $_SETTINGS["VALID_IMAGE_TYPE_FOR_UPLOAD"]; break;
        case "document":    $validExtensionForUpload = $_SETTINGS["VALID_DOCUMENT_TYPE_FOR_UPLOAD"]; break;
        case "video":       $validExtensionForUpload = $_SETTINGS["VALID_VIDEO_TYPE_FOR_UPLOAD"]; break;
        case "audio":       $validExtensionForUpload = $_SETTINGS["VALID_AUDIO_TYPE_FOR_UPLOAD"]; break;
        case "program":     $validExtensionForUpload = $_SETTINGS["VALID_PROGRAM_TYPE_FOR_UPLOAD"]; break;
        case 'all':         $validExtensionForUpload = array_merge($_SETTINGS["VALID_IMAGE_TYPE_FOR_UPLOAD"], $_SETTINGS["VALID_DOCUMENT_TYPE_FOR_UPLOAD"]); break;
    }
    
    if(!in_array($extensionName, $validExtensionForUpload)) {

        $validExtensionNameList = join(", ", $validExtensionForUpload);

        return "Invalid {$type} type. Only {$validExtensionNameList} {$type} type are allowed to upload";
    /**
     * If location is set to db then return the image as blob string
     * Otherwise save the image in the desired location
     */
    if($location == "db") {
        
        return array (
            "success"       => true,
            "imageType"     => $file["type"],
            "blobString"    => file_get_contents($file["tmp_name"])
        );
    } else {
        
        $uploadDir = DIR_UPLOAD . $location;
        if(!is_dir($uploadDir) && !mkdir($uploadDir, 0777, true)) {
            return "Error creating directory";
        }

        // If newFileName is not empty then change the file name by given
        $file_name = rand().$file["name"];
        if(!empty($newFileName)) {

            $file_extension = explode(".", $file_name);
            $file_extension = end($file_extension);
            $file_name = $newFileName . "." . $file_extension;

        }


        if(move_uploaded_file($file["tmp_name"], $uploadDir ."/" . $file_name )) {
                "success"      => true,
                "fileName"     => $file_name
            return "Can not upload the file";
        }
        /*
        //upload code here
        $data=file_get_contents($_FILES[$fileInputName]["tmp_name"]);
        //upload webp
        imagewebp(imagecreatefromstring($data),$location.$uploadedFileName.".webp",75);
        //upload orginal image
        switch($type){
            case "jpeg":  imagejpeg(imagecreatefromstring($data),$location.$uploadedFileName.".jpeg",75);
                          imagejpeg(imagescale(imagecreatefromstring($data), 200, 200), $location.$uploadedFileName."_thumb.jpeg",80);
                          
                          break;
            case "png":   imagepng(imagecreatefromstring($data),$location.$uploadedFileName.".png",75);
                          imagepng(imagescale(imagecreatefromstring($data), 200, 200), $location.$uploadedFileName."_thumb.png",80);
                          break;
            default:      imagejpeg(imagecreatefromstring($data),$location.$uploadedFileName.".jpg",75);
                          imagejpeg(imagescale(imagecreatefromstring($data), 200, 200), $location.$uploadedFileName."_thumb.jpg",80);
                          break;
        //upload webp thumb
        imagewebp(imagescale(imagecreatefromstring($data), 200, 200), $location.$uploadedFileName."_thumb.webp",80);
        
        */
    }

Fixed code:
 * Define allowed extension and mime type.

$_SETTINGS["VALID_IMAGE_TYPE_FOR_UPLOAD"] = array(
    "jpeg"  => array("image/jpeg"),
    "jpg"   => array("image/jpeg"),
    "png"   => array("image/png")
);
$_SETTINGS["VALID_DOCUMENT_TYPE_FOR_UPLOAD"] = array(
    "pdf"   => array("application/pdf"),
    "doc"   => array("application/msword"),
    "docx"  => array("vnd.openxmlformats-officedocument.wordprocessingml.document"),
    "xls"   => array("application/vnd.ms-excel"),
    "xlsx"  => array("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet")
);
$_SETTINGS["VALID_AUDIO_TYPE_FOR_UPLOAD"] = array(
    "oga"   => array("audio/ogg"),
    "opus"  => array("audio/opus"),
    "wav"   => array("audio/wav"),
    "weba"  => array("audio/webm")
);

// Valid video type for upload
$_SETTINGS["VALID_VIDEO_TYPE_FOR_UPLOAD"] = array(
    "mpeg"  => array("video/mpeg"),
    "ogv"   => array("video/ogg"),
    "webm"  => array("video/webm"),
    "mp4"   => array("video/mp4")
);

 function easyUpload( 
    $mimeType = strtolower($file["type"]);
    $extension = explode(".", $file["name"]);
    $extension = end($extension);
    $validFileForUpload = [];
        case "image":       $validFileForUpload = $_SETTINGS["VALID_IMAGE_TYPE_FOR_UPLOAD"]; break;
        case "document":    $validFileForUpload = $_SETTINGS["VALID_DOCUMENT_TYPE_FOR_UPLOAD"]; break;
        case "video":       $validFileForUpload = $_SETTINGS["VALID_VIDEO_TYPE_FOR_UPLOAD"]; break;
        case "audio":       $validFileForUpload = $_SETTINGS["VALID_AUDIO_TYPE_FOR_UPLOAD"]; break;
        case "program":     $validFileForUpload = $_SETTINGS["VALID_PROGRAM_TYPE_FOR_UPLOAD"]; break;
        case 'all':         $validFileForUpload = array_merge($_SETTINGS["VALID_IMAGE_TYPE_FOR_UPLOAD"], $_SETTINGS["VALID_DOCUMENT_TYPE_FOR_UPLOAD"]); break;
    // Validate both file extension and mime type
    if( isset( $validFileForUpload[$extension] ) AND in_array( $mimeType, $validFileForUpload[$extension] )  ) {
        /**
         * If location is set to db then return the image as blob string
         * Otherwise save the image in the desired location
         */
        if($location == "db") {
            
                "success"       => true,
                "imageType"     => $file["type"],
                "blobString"    => file_get_contents($file["tmp_name"])
            
            $uploadDir = DIR_UPLOAD . $location;
            if(!is_dir($uploadDir) && !mkdir($uploadDir, 0777, true)) {
                return "Error creating directory";
            }
            // If newFileName is not empty then change the file name by given
            $file_name = rand().$file["name"];
            if(!empty($newFileName)) {
                $file_extension = explode(".", $file_name);
                $file_extension = end($file_extension);
                $file_name = $newFileName . "." . $file_extension;
            }
            if(move_uploaded_file($file["tmp_name"], $uploadDir ."/" . $file_name )) {
                return array (
                    "success"      => true,
                    "fileName"     => $file_name
                );

            } else {

                return "Can not upload the file";

            }
    } else {
        return "Invalid {$type} type."; // Only {$validExtensionNameList} {$type} type are allowed to upload";
    }