CVE-2023-1886 (published 2023-04-05T17:15Z)

Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.\n\n

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-294
cwe_name: Authentication Bypass by Capture-replay
description: A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
extended_description: Capture-replay attacks are common and can be difficult to defeat without cryptography. They are a subset of network injection attacks that rely on observing previously-sent valid commands, then changing them slightly if necessary and resending the same commands to the server.
         

Fix information:
repo_url: https://github.com/thorsten/phpmyfaq
commit_details: repo_url: https://github.com/thorsten/phpmyfaq
author: Thorsten Rinne
author_date: 2023-02-15 17:43:04+01:00
msg: fix: corrected check on null values
repository: repo_url: https://github.com/thorsten/phpmyfaq
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: ajaxservice.php
change_type: ModificationType.MODIFY
diff: @@ -116,8 +116,8 @@ $captcha = new Captcha($faqConfig);
 $captcha->setUserIsLoggedIn($isLoggedIn);
 
 if (
-'savevoting' !== $action && 'saveuserdata' !== $action && 'changepassword' !== $action && !is_null($code) &&
-    !$captcha->checkCaptchaCode($code)
+    'savevoting' !== $action && 'saveuserdata' !== $action && 'changepassword' !== $action &&
+    !$captcha->checkCaptchaCode($code ?? '')
 ) {
     $message = ['error' => $PMF_LANG['msgCaptcha']];
 }

programming_language: PHP
filename: language_de.php
change_type: ModificationType.MODIFY
diff: @@ -155,7 +155,7 @@ $PMF_LANG['err_badID'] = "Fehlerhafte ID!";
 $PMF_LANG['err_noTopTen'] = "Derzeit sind keine beliebten FAQs verfügbar.";
 $PMF_LANG['err_nothingFound'] = "Es wurde kein Eintrag gefunden.";
 $PMF_LANG['err_SaveEntries'] = "Pflichtfelder sind <strong>Name</strong>, <strong>E-Mail-Adresse</strong>, <strong>Kategorie</strong>, <strong>Frage</strong> und <strong>Antwort</strong>!";
-$PMF_LANG['err_SaveComment'] = "Pflichtfelder sind <strong>Name</strong>, <strong>E-Mail-Adresse</strong> und <strong>Kommentar</strong>!";
+$PMF_LANG['err_SaveComment'] = "Pflichtfelder sind Name, E-Mail-Adresse und Kommentar!";
 $PMF_LANG['err_VoteTooMuch'] = "Leider konnte die Bewertung nicht gespeichert werden, da mit der IP bereits bewertet wurde.";
 $PMF_LANG['err_noVote'] = "Es wurde keine Bewertung abgegeben!";
 $PMF_LANG['err_noMailAdress'] = "Die angegebene E-Mail-Adresse ist nicht korrekt.";

programming_language: PHP
filename: Captcha.php
change_type: ModificationType.MODIFY
diff: @@ -491,10 +491,10 @@ class Captcha
      * This function checks the provided captcha code
      * if the captcha code spam protection has been activated from the general PMF configuration.
      *
-     * @param string $code Captcha Code
+     * @param string|null $code Captcha Code
      * @return bool
      */
-    public function checkCaptchaCode(string $code): bool
+    public function checkCaptchaCode(string $code = null): bool
     {
         if ($this->isUserIsLoggedIn()) {
             return true;

programming_language: PHP