CVE-2019-12530 (published 2019-06-02T17:29Z)

Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue.php, load.php, mem.php, traf.php, and uptime.php in front/sh.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-287
cwe_name: Improper Authentication
description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
extended_description: 
            
			
         
         

Fix information:
repo_url: https://github.com/stdonato/glpi-dashboard
commit_details: repo_url: https://github.com/stdonato/glpi-dashboard
author: stdonato
author_date: 2019-05-29 20:31:43-04:00
msg: 0.9.8.rc1
repository: repo_url: https://github.com/stdonato/glpi-dashboard
repo_name: stdonato/glpi-dashboard
description: Dashboard for GLPI 
repo_language: PHP
owner: stdonato
file_changes: filename: df.php
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,8 @@
 <?php
 
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
+
 $disk = exec('/bin/df -hm |grep sd | awk \'{print $1","$2","$3","$4","$5","$6}\'', $result);
 $count = exec('/bin/df -h |grep sd | awk \'{print $1","$2","$3","$4","$5","$6}\' |wc -l');
 

programming_language: PHP
filename: issue.php
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 <?php
 
-//header('Content-Type: application/json; charset=UTF-8');
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
 
 if(file_exists('/usr/bin/lsb_release')) {
 	echo substr(shell_exec('/usr/bin/lsb_release -ds'),0,21); //ubuntu - debian

programming_language: Shell
filename: load.php
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,7 @@
 <?php
 
-// /bin/cat /proc/loadavg | /usr/bin/awk '{print $1","$2","$3}'
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
 
 $cores = exec('/bin/grep -c ^processor /proc/cpuinfo');
 
@@ -8,7 +9,6 @@ $loadavg = exec('/bin/cat /proc/loadavg | /usr/bin/awk \'{print $2}\'');
 
 $load = round(($loadavg*100)/$cores ,1);
 
-//$load = $perc;	
 
 if($cores == 1) {
 	$ncores = '1 core'; }

programming_language: PHP
filename: media.php
change_type: ModificationType.MODIFY
diff: @@ -8,9 +8,6 @@ global $DB;
 Session::checkLoginUser();
 Session::checkRight("profile", READ);
 
-//$ver = explode(" ",implode(" ",plugin_version_dashboard()));
-
-
 // count years	
 $query_y = "SELECT DISTINCT DATE_FORMAT( date, '%Y' ) AS year
 FROM glpi_tickets

programming_language: PHP
filename: mem.php
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,8 @@
 <?php
 
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
+
 $totalm = exec('/usr/bin/free -tm | /usr/bin/awk \'{print $1","$2","$3-$6-$7","$4+$6+$7}\' |grep -i mem: |cut -f2 -d,');
 
 $usedm = exec('/usr/bin/free -tm | /usr/bin/awk \'{print $1","$2","$3","$4+$6+$7}\' |grep -i mem: |cut -f3 -d,');

programming_language: Perl
filename: traf.php
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,8 @@
 <?php
 
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
+
 	 $interval = 2;	
 		
     $tx_path = 'cat /sys/class/net/eth0/statistics/tx_bytes';

programming_language: PHP
filename: uptime.php
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,13 @@
 <?php
 
-$totalSeconds1 = shell_exec("/usr/bin/cut -d. -f1 /proc/uptime");
+Session::checkLoginUser();
+Session::checkRight("profile", READ);
+
+$uptime = shell_exec('uptime |cut -d" " -f4-8');
+
+echo $uptime;
+
+/*$totalSeconds1 = shell_exec("/usr/bin/cut -d'.' -f1 /proc/uptime");
 $totalSeconds = strtotime($totalSeconds1);
 $totalMin   = $totalSeconds / 60;
 $totalHours = $totalMin / 60;
@@ -10,6 +17,7 @@ $hours = floor($totalHours - ($days * 24));
 $min   = floor($totalMin - ($days * 60 * 24) - ($hours * 60));
 
 $formatUptime = '';
+
 if ($days != 0) {
     $formatUptime .= "$days d ";
 }
@@ -22,5 +30,6 @@ if ($min != 0) {
     $formatUptime .= "$min m";
 }
 
-//header('Content-Type: application/json; charset=UTF-8');
-echo ($formatUptime);
+echo ($formatUptime);*/
+
+?>
\ No newline at end of file

programming_language: PHP