CVE-2019-25099 (published 2023-01-06T13:15Z)

A vulnerability classified as critical was found in Arthmoor QSF-Portal. This vulnerability affects unknown code of the file index.php. The manipulation of the argument a leads to path traversal. The patch is identified as ea4f61e23ecb83247d174bc2e2cbab521c751a7d. It is recommended to apply a patch to fix this issue. VDB-217558 is the identifier assigned to this vulnerability.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/Arthmoor/QSF-Portal
commit_details: repo_url: https://github.com/Arthmoor/QSF-Portal
author: Arthmoor
author_date: 2019-04-29 16:38:16-06:00
msg: Tweaked the initial module selection code to block out potential attacks and notify administrators when this happens.
repository: repo_url: https://github.com/Arthmoor/QSF-Portal
repo_name: Arthmoor/QSF-Portal
description: QSF Portal - A secure, fast, and easily maintained Web community portal.
repo_language: PHP
owner: Arthmoor
file_changes: filename: ChangeLog.txt
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,7 @@ Changes for 2.0:
 * The forum for news posts is now settable in the ACP instead of being hardcoded in the PHP files.
 * The AdminCP has new icons for decoration.
 * The custom logo section of the CSS has been separated into its own file which should not need to be updated during upgrades.
+* Tweaked the initial module selection code to block out potential attacks and notify administrators when this happens.
 
    Removed:
 

programming_language: Markdown
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -30,10 +30,32 @@ if( version_compare( PHP_VERSION, "7.0.0", "<" ) ) {
 	die( 'PHP version does not meet minimum requirements. Contact your system administrator.' );
 }
 
+function log_hostile_action( $set, $qstring )
+{
+	if( isset( $set['admin_email'] ) ) {
+		$https = isset( $_SERVER['HTTPS'] ) ? 'https://' : 'http://';
+
+		$headers = "From: Your QSF Portal Site <{$set['admin_email']}>\r\n" . "X-Mailer: PHP/" . phpversion();
+
+		$agent = isset( $_SERVER['HTTP_USER_AGENT'] ) ? $_SERVER['HTTP_USER_AGENT'] : 'N/A';
+		$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? $_SERVER['REMOTE_ADDR'] : '127.0.0.1';
+
+		$error_report = "QSF Portal has intercepted a possible attack!\n";
+		$error_report .= "The details are as follows:\n\nURL: $https" . $_SERVER['SERVER_NAME'] . $_SERVER['PHP_SELF'] . "?" . $qstring . "\n";
+		$error_report .= "Querying user agent: " . $agent . "\n";
+		$error_report .= "Querying IP: " . $ip . "\n\n";
+		$error_report = str_replace( "&nbsp;", " ", html_entity_decode( $error_report ) );
+
+		@mail( $set['admin_email'], "[QSF Portal] Potential Attack Intercepted", $error_report, $headers );
+	}
+}
+
 define( 'QUICKSILVERFORUMS', true );
 
 date_default_timezone_set( 'UTC' );
 
+session_start();
+
 $time_now   = explode( ' ', microtime() );
 $time_start = $time_now[1] + $time_now[0];
 
@@ -92,23 +114,40 @@ if( !isset( $_GET['a'] ) ) {
 
 		$missing = true;
 	}
-} elseif( !file_exists( 'func/' . $_GET['a'] . '.php' ) ) {
-	$module = 'main';
-
-	if( $_GET['a'] != 'forum_rules' && $_GET['a'] != 'upload_rules' ) {
-		$qstring = $_SERVER['REQUEST_URI'];
+} elseif( !empty( $_GET['a'] ) ) {
+	if( strstr( $_GET['a'], '/' ) || strstr( $_GET['a'], '\\' ) || strstr( $_GET['a'], '.' ) ) {
+		if( isset( $_SERVER['QUERY_STRING'] ) && !empty( $_SERVER['QUERY_STRING'] ) ) {
+			$qstring = $_SERVER['QUERY_STRING'];
+		}
 
 		$missing = true;
+
+		$_SESSION = array();
+
+		session_destroy();
+
+		log_hostile_action( $set, $qstring );
+
+		header( 'Clear-Site-Data: "*"' );
+	} elseif( !file_exists( 'func/' . $_GET['a'] . '.php' ) ) {
+		$module = 'main';
+
+		if( $_GET['a'] != 'forum_rules' && $_GET['a'] != 'upload_rules' ) {
+			$qstring = $_SERVER['REQUEST_URI'];
+
+			$missing = true;
+		} else {
+			$terms_module = $_GET['a'];
+		}
 	} else {
-		$terms_module = $_GET['a'];
+		$module = $_GET['a'];
 	}
 } else {
-	$module = $_GET['a'];
-}
+	if( isset( $_SERVER['QUERY_STRING'] ) && !empty( $_SERVER['QUERY_STRING'] ) ) {
+		$qstring = $_SERVER['QUERY_STRING'];
 
-if( strstr( $module, '/' ) || strstr( $module, '\\' ) ) {
-	header( 'HTTP/1.0 403 Forbidden' );
-	exit( 'You have been banned from this site.' );
+		$missing = true;
+	}
 }
 
 // I know this looks corny and all but it mimics the output from a real 404 page.
@@ -136,8 +175,6 @@ $qsf->get['a'] = $module;
 $qsf->sets     = $qsf->get_settings( $set );
 $qsf->site     = $qsf->sets['loc_of_board']; // Will eventually replace $qsf->self once the SEO URL changes are done.
 
-session_start();
-
 $qsf->user_cl = new user( $qsf );
 $qsf->user    = $qsf->user_cl->login();
 $qsf->lang    = $qsf->get_lang( $qsf->user['user_language'], $qsf->get['a'] );

programming_language: PHP