CVE-2023-40173 (published 2023-08-18T22:15Z)

Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this issue.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-522
cwe_name: Insufficiently Protected Credentials
description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/fobybus/social-media-skeleton
commit_details: repo_url: https://github.com/fobybus/social-media-skeleton
author: fobybus
author_date: 2023-08-15 10:26:56-07:00
msg: fixed csrf bug,improved admin/atask/setting.php and added passw.php
repository: repo_url: https://github.com/fobybus/social-media-skeleton
repo_name: fobybus/social-media-skeleton
description: uncompleted social media project implemented using a php, css ,javascript and html
repo_language: PHP
owner: fobybus
file_changes: filename: adminlogin.html
change_type: ModificationType.MODIFY
diff: @@ -37,9 +37,9 @@
 				<fieldset id="field1">
 					<legend>admin login</legend>
 					EMAIL:<br>
-					<input class="inputf" type="email" name="email"> <br>
+					<input class="inputf" type="email" name="email" required> <br>
 					PASSWORD:<br>
-					<input class="inputf" type="password" name="password">
+					<input class="inputf" type="password" name="password" required>
 					<br>
 					<input class="buf" type="submit" value="login"><br>
 				</fieldset>

programming_language: HTML
filename: add.html
change_type: ModificationType.DELETE
diff: @@ -1,53 +0,0 @@
-
-<html lang="en-us">
-
-    <head>
-        <title> admin homepage </title>
-        <meta charset="utf-8">
-        <meta name="viewport" content="width=device-width,intial-scale=1.0">
-        <meta name="keywords"
-            content="social media,the best social media platform,chat with your friend ,easy social media,pipago">
-        <meta name="description" content="light weight secured student's social media!!!">
-        <meta name="author" content="black eagle team">
-        <link rel="stylesheet" href="../home.css">
-    </head>
-    <!-- body goes here -->
-    
-    <body>
-        <!--header-->
-        <header>
-            <!-- -navigation links-->
-            <nav>
-    
-                <ul>
-                    <li><a href="../home.php">pipa analytics</a></li>
-                    <li><a href="../mg.php" >manage user </a></li>
-                    <li><a href="#" style="background-color: black;"> add admin </a></li>
-                    <li><a href="setting.php">setting</a></li>
-                    <li><a href="logout.php">logout</a></li>
-                </ul>
-    
-            </nav>
-    
-        </header>
-        <!-- content-->
-        <main>
-      <div class="addbox">
-    <form class="adform" action="add.php" method="POST">
-    <label>email</label><br>
-    <input type="email" name="email"><br>
-    <label>password</label><br>
-    <input type="password" name="password">
-    <input class="addbutton" type="submit" value="add">
-    </form>
-    
-      </div>
-        </main>
-        <!--footer content-->
-        <footer>
-    
-    
-        </footer>
-    </body>
-    
-    </html>
\ No newline at end of file

programming_language: unknown
filename: add.php
change_type: ModificationType.MODIFY
diff: @@ -1,41 +1,114 @@
 
 <?php
+require("../../tasks/passw.php");
 session_start();
 if(!isset($_SESSION["aid"]))
 {
-	header("location:adminlogin.html");
+	header("location:../adminlogin.html");
    exit();
 }
-$uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
-$upass=htmlspecialchars($_POST["password"], ENT_QUOTES, 'UTF-8');
 
-//if empty password or username!
-//alt isempty
-if($uemail=="" || $upass=="")
+if($_SERVER['REQUEST_METHOD'] == 'POST')
 {
-  header("location:add.html");
-  exit();
-}
-require("../../tasks/condb.php");
-
-// Create a prepared statement to prevent SQL injection
-$query = "INSERT INTO admin (email, password) VALUES (?, ?)";
-$stmt = mysqli_prepare($dbcon, $query);
-mysqli_stmt_bind_param($stmt, "ss", $uemail, $upass);
-$result = mysqli_stmt_execute($stmt);
+  $uemail=htmlspecialchars($_POST["email"], ENT_QUOTES, 'UTF-8');
+  $upass=$_POST["password"];
 
-if($result)
-{
-  echo("<p style='color:green;position:absolute;left:250px;top:70px'> successfully added $uemail</p>");
- include("add.html");
+     //check token 
+     if(isset($_SESSION["c-token"]) && isset($_POST["csrf-token"]))
+     {
+       $tok=$_POST["csrf-token"];
+       if($_SESSION["c-token"]!=$tok)
+       {
+         exit("action denied!");
+       }
+     } else {
+         exit("action denied!");
+     }
+    
+  //if empty password or username!
+  //alt isempty
+  if($uemail=="" || $upass=="")
+  {
+    header("location:add.php");
+    exit();
+  }
+  require("../../tasks/condb.php");
+  
+  // Create a prepared statement to prevent SQL injection
+  $query = "INSERT INTO admin (email, password) VALUES (?, ?)";
+  $stmt = mysqli_prepare($dbcon, $query);
+  mysqli_stmt_bind_param($stmt, "ss", $uemail, $upass);
+  $result = mysqli_stmt_execute($stmt);
+  
+  if($result)
+  {
+    echo("<p style='color:green;position:absolute;left:250px;top:70px'> successfully added $uemail</p>");
+    $dbcon->close();
+  }  else {
+  echo("some thing want wrong please try again!");
   $dbcon->close();
-  exit();
-}  else {
-echo("some thing want wrong please try again!");
-$dbcon->close();
-include("add.html");
+  }
 }
 
-
+//gen ctoken
+$tok=$_SESSION["c-token"]=generateSalt();
 
 ?>
+
+
+
+
+
+<html lang="en-us">
+
+    <head>
+        <title> admin homepage </title>
+        <meta charset="utf-8">
+        <meta name="viewport" content="width=device-width,initial-scale=1.0">
+        <meta name="keywords"
+            content="social media,the best social media platform,chat with your friend ,easy social media,pipago">
+        <meta name="description" content="light weight secured student's social media!!!">
+        <meta name="author" content="black eagle team">
+        <link rel="stylesheet" href="../home.css">
+    </head>
+    <!-- body goes here -->
+    
+    <body>
+        <!--header-->
+        <header>
+            <!-- -navigation links-->
+            <nav>
+    
+                <ul>
+                    <li><a href="../home.php">pipa analytics</a></li>
+                    <li><a href="../mg.php" >manage user </a></li>
+                    <li><a href="#" style="background-color: black;"> add admin </a></li>
+                    <li><a href="setting.php">setting</a></li>
+                    <li><a href="logout.php">logout</a></li>
+                </ul>
+    
+            </nav>
+    
+        </header>
+        <!-- content-->
+        <main>
+      <div class="addbox">
+    <form class="adform" action="add.php" method="POST">
+    <label>email</label><br>
+    <input type="email" name="email" required><br>
+    <label>password</label><br>
+    <input type="password" name="password" required>
+    <input type="text" name="csrf-token" value="<?php echo $tok; ?>" hidden>
+    <input class="addbutton" type="submit" value="add">
+    </form>
+    
+      </div>
+        </main>
+        <!--footer content-->
+        <footer>
+    
+    
+        </footer>
+    </body>
+    
+    </html>
\ No newline at end of file

programming_language: PHP
filename: setting.php
change_type: ModificationType.MODIFY
diff: @@ -18,33 +18,26 @@ if($_SERVER['REQUEST_METHOD'] == 'POST')
 	$putold=false;
 
 	//is email changed 
-	if(isset($_POST['email']))
+	if(isset($_POST['email']) && $_POST['email']!="")
 	{
 	$echanged=true;
 	$newemail=htmlspecialchars($_POST['email'], ENT_QUOTES, 'UTF-8');
 	} 
 	//is pass ^^
-	if(isset($_POST['password']))
+	if(isset($_POST['password']) && $_POST['password']!="")
 	{
 	$pchanged=true;
-	$newpass=htmlspecialchars($_POST['password'], ENT_QUOTES, 'UTF-8');
+	$newpass=$_POST['password'];
 	} 
-	if(isset($_POST['oldpass']))
+	if(isset($_POST['oldpass']) && $_POST['oldpass']!="")
 	{
 		$putold=true;
-		$oldpass=htmlspecialchars($_POST['oldpass'], ENT_QUOTES, 'UTF-8');
+		$oldpass=$_POST['oldpass'];
 		
 	}
 /*************************************************** */
-// SQLi prevention through parameterization
-$id = $_SESSION["aid"];
-$q = "SELECT * FROM admin WHERE admin_id=?";
-$stmt = mysqli_prepare($dbcon, $q);
-mysqli_stmt_bind_param($stmt, "i", $id);
-mysqli_stmt_execute($stmt);
-$result = mysqli_stmt_get_result($stmt);
-$row = $result->fetch_assoc(); 
-$rpass = $row["password"];  //real
+$id=$_SESSION["aid"];
+$rpass = $_SESSION["password"];  //actual pass
 
 if ($pchanged && $oldpass == $rpass) {
     // change the password 
@@ -52,7 +45,12 @@ if ($pchanged && $oldpass == $rpass) {
     $stmt = mysqli_prepare($dbcon, $q);
     mysqli_stmt_bind_param($stmt, "si", $newpass, $id);
     mysqli_stmt_execute($stmt);
+	$_SESSION["password"]=$newpass;
     echo "changed the password <br>";
+} 
+
+if (($pchanged && $oldpass != $rpass) || ($echanged && $oldpass != $rpass)) {
+    echo "incorrect attempt! <br>";
 }  
 
 if ($echanged && $oldpass == $rpass) {
@@ -64,6 +62,7 @@ if ($echanged && $oldpass == $rpass) {
 }
 /***************************************************** */
 }
+$dbcon->close();
 ?> 
 
 <html lang="en-us">
@@ -89,7 +88,7 @@ if ($echanged && $oldpass == $rpass) {
 			<ul>
 				<li><a href="../home.php">pipa analytics</a></li>
 				<li><a href="../mg.php">manage user </a></li>
-				<li><a href="add.html"> add admin </a></li>
+				<li><a href="add.php"> add admin </a></li>
 				<li><a href="#"  style="background-color: black;">setting</a></li>
 				<li><a href="logout.php">logout</a></li>
 			</ul>
@@ -103,9 +102,9 @@ if ($echanged && $oldpass == $rpass) {
     <div class="adminsetting1">
 		<form action="" method="post">
 		<label >email</label><br>
-    <input type="email" name="email" required><br>
+    <input type="email" name="email"  placeholder="unchanged"><br>
 	<label >new password</label><br>
-	<input type="password" name="password" required><br>
+	<input type="password" name="password" placeholder="unchanged"><br>
 	<label >old password</label><br>
 	<input type="password" name="oldpass" required title="old password required to save changes" ><br>
 	<input type="submit" id="submitb" value="save changes">

programming_language: PHP
filename: home.php
change_type: ModificationType.MODIFY
diff: @@ -32,7 +32,7 @@ session_start();
 			<ul>
 				<li><a href="#" style="background-color: black;">pipa analytics</a></li>
 				<li><a href="mg.php">manage user </a></li>
-				<li><a href="atask/add.html"> add admin </a></li>
+				<li><a href="atask/add.php"> add admin </a></li>
 				<li><a href="atask/setting.php">setting</a></li>
 				<li><a href="atask/logout.php">logout</a></li>
 			</ul>

programming_language: PHP
filename: login.php
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 <?php
 include("../tasks/condb.php");
-if(!isset($_POST["email"]));
+if(!isset($_POST["email"]))
 header("location:adminlogin.html");
 //handle the form 
 $uemail=$_POST["email"];
@@ -19,15 +19,13 @@ if($result->num_rows>0)
   $id=$rows["admin_id"];
   session_start();
   $_SESSION["aid"]=$id;
-  $dbcon->close();
+  $_SESSION["password"]=$rows["password"];
  header("location:home.php");
-    exit;
 }  else {
-  $dbcon->close();
-    echo "<p style='color:red;text-align:center;font-size:20px;position: absolute;left:700px;top:250px;'> incorrect password or email  </p>";
+    echo "<p style='color:red;text-align:center;font-size:20px;'> incorrect password or email  </p>";
    require('adminlogin.html');
-    exit();
 }
+$dbcon->close();
 
 ?>
 

programming_language: PHP
filename: mg.php
change_type: ModificationType.MODIFY
diff: @@ -37,7 +37,7 @@ if(!isset($_SESSION["aid"]))
             <ul>
                 <li><a href="home.php">pipa analytics</a></li>
                 <li><a href="#" style="background-color: black;">manage user </a></li>
-                <li><a href="atask/add.html"> add admin </a></li>
+                <li><a href="atask/add.php"> add admin </a></li>
                 <li><a href="atask/setting.php">setting</a></li>
                 <li><a href="atask/logout.php">logout</a></li>
             </ul>

programming_language: PHP
filename: login.php
change_type: ModificationType.MODIFY
diff: @@ -65,7 +65,7 @@ $dbcon->close();
     exit;
 }  else {
   $dbcon->close();
-    echo "<p style='color:red;text-align:center;font-size:20px;position: absolute;left:700px;top:250px;'> incorrect password or email  </p>";
+    echo "<p style='color:red;text-align:center;font-size:20px;'> incorrect password or email  </p>";
    require('login.html');
     exit();
 }

programming_language: PHP
filename: passw.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,17 @@
+<?php
+
+//generate salt 
+function generateSalt()
+{
+  $randb=random_bytes(16);
+  return bin2hex($randb);
+}
+
+//hash password 
+function hashPass($plain,$salt)
+{
+    $password=$plain.$salt;
+    return hash("sha256",$password);
+}
+
+?>
\ No newline at end of file

programming_language: PHP
filename: home.js
change_type: ModificationType.MODIFY
diff: @@ -29,4 +29,10 @@ function fill(fname,lname,email,city)
     document.getElementById("city").setAttribute("value",city);
 }
 
+//set token 
+function setToken(token)
+{
+  document.getElementById("csrf-token").setAttribute("value",token);
+}
+
 

programming_language: JavaScript
filename: setting.html
change_type: ModificationType.MODIFY
diff: @@ -47,6 +47,7 @@
 		<label for="fname">First Name</label><input type="name" name="fname" id="fname" required><br>
 		<label for="lname">Last Name</label><input type="name" name="lname" id="lname" required><br>
 		<label for="city">City Name</label><input type="text" name="city" id="city" required><br>
+		<input type="text" name="csrf-token" id="csrf-token" hidden>
 		<input type="hidden" name="ch-info"><br>
 		<input type="submit" value="save changes">
 	</form>

programming_language: HTML
filename: setting.php
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,6 @@
 <?php
 require("../tasks/condb.php");
+require("../tasks/passw.php");
 session_start();
 if(!isset($_SESSION["id"]))
 {
@@ -15,6 +16,20 @@ if(isset($_POST["ch-info"]))
    $email=htmlspecialchars($_POST["email"],ENT_QUOTES,"UTF-8");
    $city=htmlspecialchars($_POST["city"],ENT_QUOTES,"UTF-8");
    $id=$_SESSION["id"];
+   
+    //check token 
+    if(isset($_SESSION["c-token"]) && isset($_POST["csrf-token"]))
+    {
+      $tok=$_POST["csrf-token"];
+      if($_SESSION["c-token"]!=$tok)
+      {
+        exit("action denied!");
+      }
+    } else {
+        exit("action denied!");
+    }
+   
+    
    //no validation from server side 
    $query="update users set fname=?,lname=?,email=?,city=? where id=?";
    $st=$dbcon->prepare($query);
@@ -52,6 +67,8 @@ $ln=$_SESSION["lname"];
 $email=$_SESSION["email"];
 $city=$_SESSION["city"];
 echo "<script> fill('$fn','$ln','$email','$city')</script>";
+$tok=$_SESSION["c-token"]=generateSalt();
+echo "<script>setToken('$tok')</script>";
 $dbcon->close();
 
 ?>
\ No newline at end of file

programming_language: PHP
repo_url: https://github.com/fobybus/social-media-skeleton
commit_details: repo_url: https://github.com/fobybus/social-media-skeleton
author: fobybus
author_date: 2023-08-15 06:06:34-07:00
msg: added salting tables and modified password for default users
repository: repo_url: https://github.com/fobybus/social-media-skeleton
repo_name: fobybus/social-media-skeleton
description: uncompleted social media project implemented using a php, css ,javascript and html
repo_language: PHP
owner: fobybus
file_changes: filename: pipago_db.sql
change_type: ModificationType.MODIFY
diff: @@ -1,9 +1,10 @@
+-- use password123 for both normal and admin user 
 -- phpMyAdmin SQL Dump
 -- version 5.1.3
 -- https://www.phpmyadmin.net/
 --
 -- Host: 127.0.0.1
--- Generation Time: Apr 25, 2022 at 04:18 PM
+-- Generation Time: Aug 15, 2023 at 03:01 PM
 -- Server version: 10.4.24-MariaDB
 -- PHP Version: 7.4.28
 
@@ -40,7 +41,26 @@ CREATE TABLE `admin` (
 --
 
 INSERT INTO `admin` (`admin_id`, `email`, `password`) VALUES
-(1000, 'admin1@pipago.com', 'admin1login');
+(1000, 'admin@pipago.com', '86dd76e74017a9a4856c5c6d6937e471fa6f80f41b720428c0a73610d7dbbe75');
+
+-- --------------------------------------------------------
+
+--
+-- Table structure for table `adminsalt`
+--
+
+CREATE TABLE `adminsalt` (
+  `sid` int(11) NOT NULL COMMENT 'salt id',
+  `aid` int(11) NOT NULL COMMENT 'admin id',
+  `salt` varchar(32) NOT NULL COMMENT 'salt'
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+--
+-- Dumping data for table `adminsalt`
+--
+
+INSERT INTO `adminsalt` (`sid`, `aid`, `salt`) VALUES
+(1, 1000, '65c53cd5c62fec1766ad6bef6aac1253');
 
 -- --------------------------------------------------------
 
@@ -158,7 +178,26 @@ CREATE TABLE `users` (
 --
 
 INSERT INTO `users` (`id`, `fname`, `lname`, `bday`, `city`, `email`, `password`, `gender`, `edu`, `last_seen`, `joined`, `avatar`) VALUES
-(1001, 'firaol', 'wakuma', '2022-04-21', 'addis abeba ', 'firaol@email.com', 'password123', 'male', 'is', '2022-04-25 14:47:39', '2022-04-25 14:47:39', '');
+(1001, 'firaol', 'wakuma', '2022-04-21', 'addis abeba ', 'firaol@email.com', '49620aa0869973f5584dbdefc5c50b23646cab16e3f16a5cbe27cfd1a81d55d7', 'male', 'is', '2023-08-15 11:40:15', '2022-04-25 14:47:39', '');
+
+-- --------------------------------------------------------
+
+--
+-- Table structure for table `usersalt`
+--
+
+CREATE TABLE `usersalt` (
+  `sid` int(11) NOT NULL COMMENT 'salt id',
+  `uid` int(11) NOT NULL COMMENT 'user id',
+  `salt` varchar(32) NOT NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+--
+-- Dumping data for table `usersalt`
+--
+
+INSERT INTO `usersalt` (`sid`, `uid`, `salt`) VALUES
+(1, 1001, '00e7a17d32f03da112294fbed42f3c4c');
 
 --
 -- Indexes for dumped tables
@@ -170,6 +209,13 @@ INSERT INTO `users` (`id`, `fname`, `lname`, `bday`, `city`, `email`, `password`
 ALTER TABLE `admin`
   ADD PRIMARY KEY (`admin_id`);
 
+--
+-- Indexes for table `adminsalt`
+--
+ALTER TABLE `adminsalt`
+  ADD PRIMARY KEY (`sid`),
+  ADD KEY `aid` (`aid`);
+
 --
 -- Indexes for table `blocking`
 --
@@ -229,6 +275,13 @@ ALTER TABLE `post`
 ALTER TABLE `users`
   ADD PRIMARY KEY (`id`);
 
+--
+-- Indexes for table `usersalt`
+--
+ALTER TABLE `usersalt`
+  ADD PRIMARY KEY (`sid`),
+  ADD KEY `uid` (`uid`);
+
 --
 -- AUTO_INCREMENT for dumped tables
 --
@@ -239,6 +292,12 @@ ALTER TABLE `users`
 ALTER TABLE `admin`
   MODIFY `admin_id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=1037;
 
+--
+-- AUTO_INCREMENT for table `adminsalt`
+--
+ALTER TABLE `adminsalt`
+  MODIFY `sid` int(11) NOT NULL AUTO_INCREMENT COMMENT 'salt id', AUTO_INCREMENT=2;
+
 --
 -- AUTO_INCREMENT for table `blocking`
 --
@@ -287,10 +346,22 @@ ALTER TABLE `post`
 ALTER TABLE `users`
   MODIFY `id` int(20) NOT NULL AUTO_INCREMENT COMMENT 'id', AUTO_INCREMENT=1002;
 
+--
+-- AUTO_INCREMENT for table `usersalt`
+--
+ALTER TABLE `usersalt`
+  MODIFY `sid` int(11) NOT NULL AUTO_INCREMENT COMMENT 'salt id', AUTO_INCREMENT=2;
+
 --
 -- Constraints for dumped tables
 --
 
+--
+-- Constraints for table `adminsalt`
+--
+ALTER TABLE `adminsalt`
+  ADD CONSTRAINT `adminsalt_ibfk_1` FOREIGN KEY (`aid`) REFERENCES `admin` (`admin_id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
 --
 -- Constraints for table `blocking`
 --
@@ -337,6 +408,12 @@ ALTER TABLE `note`
 --
 ALTER TABLE `post`
   ADD CONSTRAINT `poster_id_fk` FOREIGN KEY (`poster`) REFERENCES `users` (`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+--
+-- Constraints for table `usersalt`
+--
+ALTER TABLE `usersalt`
+  ADD CONSTRAINT `usersalt_ibfk_1` FOREIGN KEY (`uid`) REFERENCES `users` (`id`) ON DELETE CASCADE ON UPDATE CASCADE;
 COMMIT;
 
 /*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;

programming_language: SQL