Vulnerability: Integer Overflow or Wraparound in Microweber Microweber prior to 1.2.12 is vulnerable to Integer Overflow or Wraparound.
Vulnerability ID: GHSA-c383-q5vf-hx55
CWE: CWE-190
Severity score: 7.5
Project: https://github.com/microweber/microweber
Published: 2022-03-12
File: src/MicroweberPackages/Checkout/Http/Controllers/Traits/ShippingTrait.php
Commit message: checkout shipping address validation - max chars allowed
Commit author: Bozhidar Slaveykov

Vulnerable version (before fix):
 public function shippingMethodSave(Request $request) {          if (is_array($request->get('Address'))) {             $request->merge([                'city'=>$request->get('Address')['city'],                'zip'=>$request->get('Address')['zip'],                'state'=>$request->get('Address')['state'],                'address'=>$request->get('Address')['address'],             ]);         }          session_append_array('checkout_v2', [             'shipping_gw'=> $request->get('shipping_gw'),             'city'=> $request->get('city'),

Fixed version (after fix):
 public function shippingMethodSave(Request $request) {          if (is_array($request->get('Address'))) {             $request->merge([                 'city'=>$request->get('Address')['city'],                 'zip'=>$request->get('Address')['zip'],                 'state'=>$request->get('Address')['state'],                 'address'=>$request->get('Address')['address'],             ]);         }          $rules = [];         $rules['shipping_gw'] = 'max:500';         $rules['city'] = 'max:500';         $rules['address'] = 'max:500';         $rules['country'] = 'max:500';         $rules['state'] = 'max:500';         $rules['zip'] = 'max:500';         $rules['other_info'] = 'max:500';          $validator = Validator::make($request->all(), $rules);          if ($validator->fails()) {             $errors = $validator->messages()->toArray();             session_set('errors', $errors);             return redirect(route('checkout.shipping_method'));         }          session_append_array('checkout_v2', [             'shipping_gw'=> $request->get('shipping_gw'),             'city'=> $request->get('city'),

Patch:
patch: @@ -38,13 +38,30 @@ public function shippingMethodSave(Request $request) {
 
         if (is_array($request->get('Address'))) {
             $request->merge([
-               'city'=>$request->get('Address')['city'],
-               'zip'=>$request->get('Address')['zip'],
-               'state'=>$request->get('Address')['state'],
-               'address'=>$request->get('Address')['address'],
+                'city'=>$request->get('Address')['city'],
+                'zip'=>$request->get('Address')['zip'],
+                'state'=>$request->get('Address')['state'],
+                'address'=>$request->get('Address')['address'],
             ]);
         }
 
+        $rules = [];
+        $rules['shipping_gw'] = 'max:500';
+        $rules['city'] = 'max:500';
+        $rules['address'] = 'max:500';
+        $rules['country'] = 'max:500';
+        $rules['state'] = 'max:500';
+        $rules['zip'] = 'max:500';
+        $rules['other_info'] = 'max:500';
+
+        $validator = Validator::make($request->all(), $rules);
+
+        if ($validator->fails()) {
+            $errors = $validator->messages()->toArray();
+            session_set('errors', $errors);
+            return redirect(route('checkout.shipping_method'));
+        }
+
         session_append_array('checkout_v2', [
             'shipping_gw'=> $request->get('shipping_gw'),
             'city'=> $request->get('city'),
path: src/MicroweberPackages/Checkout/Http/Controllers/Traits/ShippingTrait.php