CVE-2014-125080 (published 2023-01-16T18:15Z)

A vulnerability has been found in frontaccounting faplanet and classified as critical. This vulnerability affects unknown code. The manipulation leads to path traversal. The patch is identified as a5dcd87f46080a624b1a9ad4b0dd035bbd24ac50. It is recommended to apply a patch to fix this issue. VDB-218398 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/frontaccounting/faplanet
commit_details: repo_url: https://github.com/frontaccounting/faplanet
author: Janusz Dobrowolski
author_date: 2014-04-26 00:57:39+02:00
msg: Fixed directory traversal issues.
repository: repo_url: https://github.com/frontaccounting/faplanet
repo_name: frontaccounting/faplanet
description: FrontAccounting UI redesign
repo_language: PHP
owner: frontaccounting
file_changes: filename: inst_module.php
change_type: ModificationType.MODIFY
diff: @@ -42,8 +42,8 @@ function local_extension($id)
 			'active' => false
 	);
 
-	if (file_exists($path_to_root.'/modules/'.$id.'/hooks.php')) {
-		include_once($path_to_root.'/modules/'.$id.'/hooks.php');
+	if (file_exists($path_to_root.'/modules/'.clean_file_name($id).'/hooks.php')) {
+		include_once($path_to_root.'/modules/'.clean_file_name($id).'/hooks.php');
 	}
 	$hooks_class = 'hooks_'.$id;
 	if (class_exists($hooks_class, false)) {

programming_language: PHP
filename: hooks.inc
change_type: ModificationType.MODIFY
diff: @@ -225,9 +225,10 @@ function install_hooks()
 	$Hooks = array();
 	
 	// include current language related $Hooks object if locale file exists
-	if (file_exists($path_to_root . "/lang/".$_SESSION['language']->code."/locale.inc"))
+	$lang_code  = clean_file_name($_SESSION['language']->code);
+	if (file_exists($path_to_root . "/lang/" . $lang_code . "/locale.inc"))
 	{
-		include_once($path_to_root . "/lang/".$_SESSION['language']->code."/locale.inc");
+		include_once($path_to_root . "/lang/" . $lang_code . "/locale.inc");
 		$code = $_SESSION['language']->code;
 		$hook_class = 'hooks_'.$code;
 		$Hooks[$code] = new $hook_class;

programming_language: PHP