CVE-2024-25410 (published 2024-02-26T16:27Z)

flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/flusity/flusity-CMS
commit_details: repo_url: https://github.com/flusity/flusity-CMS
author: Darius Jakaitis
author_date: 2024-02-03 15:41:41+02:00
msg: Update update_setting.php

Signed-off-by: Darius Jakaitis <105962203+flusity@users.noreply.github.com>
repository: repo_url: https://github.com/flusity/flusity-CMS
repo_name: flusity/flusity-CMS
repo_language: PHP
owner: flusity
file_changes: filename: update_setting.php
change_type: ModificationType.MODIFY
diff: @@ -8,14 +8,13 @@ define('IS_ADMIN', true);
 $configurations = require $_SERVER['DOCUMENT_ROOT'] . '/security/config.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/core/functions/functions.php';
 
-require_once $_SERVER['DOCUMENT_ROOT'] . '/security/config.php';
 require_once $_SERVER['DOCUMENT_ROOT'] . '/core/functions/functions.php';
 define('ROOT_PATH', $_SERVER['DOCUMENT_ROOT'] . '/');
 
 $config = $configurations['config'];
 $prefix = $configurations['prefix'];
 
- $db = getDBConnection($config);
+$db = getDBConnection($config);
 secureSession($db, $prefix);
 $language_code = getLanguageSetting($db, $prefix);
 $translations = getTranslations($db, $prefix, $language_code);
@@ -23,39 +22,36 @@ $translations = getTranslations($db, $prefix, $language_code);
 $result = ['error_message' => false];
 $updateResult = ['error_message' => false];
 
-if (isset($_POST['site_title'], $_POST['meta_description'], $_POST['footer_text'], $_POST['pretty_url'], $_POST['bilingualism'], $_POST['language'],
- $_POST['posts_per_page'], $_POST['registration_enabled'], $_POST['session_lifetime'], $_POST['default_keywords'])) { 
+if (isset($_POST['site_title'], $_POST['meta_description'], $_POST['footer_text'], $_POST['pretty_url'], $_POST['bilingualism'], $_POST['language'], $_POST['posts_per_page'], $_POST['registration_enabled'], $_POST['session_lifetime'], $_POST['default_keywords'])) {
 
     $allowed_file_types = ['image/png', 'image/jpeg', 'image/gif'];
-    $target_dir = ROOT_PATH. "/uploads/";
+    $allowed_file_extensions = ['png', 'jpeg', 'jpg', 'gif']; // Pridėtas leidžiamų plėtinių sąrašas
+    $target_dir = ROOT_PATH . "/uploads/";
     $max_file_size = 100 * 1024; // Maximum file size (100KB)
     $brand_icone = null; // Initialize this variable before if condition
 
     if (isset($_FILES["brand_icone"]) && $_FILES["brand_icone"]["size"] > 0) {
         $uploaded_file = $_FILES["brand_icone"];
-        $unique_code = bin2hex(random_bytes(8));
         $filename_parts = pathinfo($uploaded_file["name"]);
-        $new_filename = $filename_parts['filename'] . '_' . $unique_code . '.' . $filename_parts['extension'];
-        $target_file = $target_dir . basename($new_filename);
-        $brand_icone = $new_filename; // Use the new filename
-  
-        if (!in_array($uploaded_file['type'], $allowed_file_types)) {
-            $_SESSION['error_message'] = t("Invalid file type.");
-           
-        } 
+        $file_extension = strtolower($filename_parts['extension']); // Paverčiama mažosiomis raidėmis, kad būtų lengviau palyginti
 
-        if ($uploaded_file['size'] > $max_file_size) {
+        if (!in_array($uploaded_file['type'], $allowed_file_types) || !in_array($file_extension, $allowed_file_extensions)) {
+            $_SESSION['error_message'] = t("Invalid file type or extension.");
+        } elseif ($uploaded_file['size'] > $max_file_size) {
             $_SESSION['error_message'] = t("File size exceeded limit.");
-           
-        } 
-
-        if (move_uploaded_file($uploaded_file["tmp_name"], $target_file)) {
-            $file_url = $_SERVER['REQUEST_SCHEME'] . "://" . $_SERVER['HTTP_HOST'] . "/uploads/" . $new_filename;
-            saveFileToDatabase($db, $prefix, $new_filename, $file_url);
-            $_SESSION['success_message'] = "File" ." ". basename($uploaded_file["name"]) . " " .t("file uploaded successfully.");
         } else {
-            $_SESSION['error_message'] = t("Error loading file.");
-         
+            $unique_code = bin2hex(random_bytes(8));
+            $new_filename = $filename_parts['filename'] . '_' . $unique_code . '.' . $file_extension;
+            $target_file = $target_dir . basename($new_filename);
+            $brand_icone = $new_filename; // Use the new filename
+
+            if (move_uploaded_file($uploaded_file["tmp_name"], $target_file)) {
+                $file_url = $_SERVER['REQUEST_SCHEME'] . "://" . $_SERVER['HTTP_HOST'] . "/uploads/" . $new_filename;
+                saveFileToDatabase($db, $prefix, $new_filename, $file_url);
+                $_SESSION['success_message'] = "File " . basename($uploaded_file["name"]) . " " . t("file uploaded successfully.");
+            } else {
+                $_SESSION['error_message'] = t("Error loading file.");
+            }
         }
     } elseif (isset($_POST['brand_icone_id']) && !empty($_POST['brand_icone_id'])) {
         // Fetch the file using its id
@@ -63,6 +59,7 @@ if (isset($_POST['site_title'], $_POST['meta_description'], $_POST['footer_text'
         $brand_icone = $file['name'];
     }
 
+
     $site_title = $_POST['site_title'];
     $meta_description = $_POST['meta_description'];
     $footer_text_settings = $_POST['footer_text'];
@@ -92,4 +89,4 @@ if (isset($_POST['site_title'], $_POST['meta_description'], $_POST['footer_text'
 
 echo json_encode($updateResult); 
 
-?>
\ No newline at end of file
+?>

programming_language: PHP