CVE-2023-2665 (published 2023-05-12T01:15Z)

Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-922
cwe_name: Insecure Storage of Sensitive Information
description: The product stores sensitive information without properly limiting read or write access by unauthorized actors.
extended_description: If read access is not properly restricted, then attackers can steal the sensitive information. If write access is not properly restricted, then attackers can modify and possibly delete the data, causing incorrect results and possibly a denial of service.
         

Fix information:
repo_url: https://github.com/francoisjacquet/rosariosis
commit_details: repo_url: https://github.com/francoisjacquet/rosariosis
author: François Jacquet
author_date: 2023-04-11 18:45:04+02:00
msg: Add microseconds to filename format to make it harder to predict
repository: repo_url: https://github.com/francoisjacquet/rosariosis
repo_name: francoisjacquet/rosariosis
description: RosarioSIS Student Information System for school management.
repo_language: PHP
owner: francoisjacquet
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -10,6 +10,7 @@ Changes in 11.0
 - Translate "Zip" & "Zipcode" to "Zip Code" in GetStuList.fnc.php, MyReport.php, Registration.fnc.php, Schools.php & Address.inc.php
 - HTML Text input min size is 2 in Inputs.php
 - Skip School Period column if has no students scheduled for selected date in Administration.php
+- Add microseconds to filename format to make it harder to predict in FileUpload.fnc.php, Accounting/functions.php, PortalNotes.php & Student_Billing/functions.php
 
 Changes in 10.9.3
 -----------------

programming_language: Markdown
filename: FileUpload.fnc.php
change_type: ModificationType.MODIFY
diff: @@ -408,7 +408,8 @@ function FilesUploadUpdate( $table, $request, $path, $id = 0 )
 			mb_strrpos( $_FILES[ $input ]['name'], '.' )
 		) );
 
-		$file_name_no_ext .= '_' . date( 'Y-m-d_His' );
+		// @since 11.0 Add microseconds to filename format to make it harder to predict.
+		$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
 
 		$new_file = FileUpload(
 			$input,

programming_language: PHP
filename: functions.inc.php
change_type: ModificationType.MODIFY
diff: @@ -351,7 +351,8 @@ function _saveSalariesFile( $id )
 		mb_strrpos( $_FILES[ $input ]['name'], '.' )
 	) );
 
-	$file_name_no_ext .= '_' . date( 'Y-m-d_His' );
+	// @since 11.0 Add microseconds to filename format to make it harder to predict.
+	$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
 
 	$file_attached = FileUpload(
 		$input,

programming_language: PHP
filename: PortalNotes.php
change_type: ModificationType.MODIFY
diff: @@ -127,12 +127,24 @@ if ( $_REQUEST['modfunc'] === 'update'
 
 				if ( isset( $_FILES['FILE_ATTACHED_FILE'] ) )
 				{
+					$file_name_no_ext = no_accents( mb_substr(
+						$_FILES['FILE_ATTACHED_FILE']['name'],
+						0,
+						mb_strrpos( $_FILES['FILE_ATTACHED_FILE']['name'], '.' )
+					) );
+
+					// @since 11.0 Add microseconds to filename format to make it harder to predict.
+					$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
+
+					// File attached to portal notes
 					$columns['FILE_ATTACHED'] = FileUpload(
 						'FILE_ATTACHED_FILE',
 						$PortalNotesFilesPath,
 						FileExtensionWhiteList(),
 						0,
-						$error
+						$error,
+						'',
+						$file_name_no_ext
 					);
 
 					// @since 6.8 Fix SQL error when quote in uploaded file name.

programming_language: PHP
filename: functions.inc.php
change_type: ModificationType.MODIFY
diff: @@ -429,7 +429,8 @@ function _saveFeesFile( $id )
 		mb_strrpos( $_FILES[ $input ]['name'], '.' )
 	) );
 
-	$file_name_no_ext .= '_' . date( 'Y-m-d_His' );
+	// @since 11.0 Add microseconds to filename format to make it harder to predict.
+	$file_name_no_ext .= '_' . date( 'Y-m-d_His' ) . '.' . substr( (string) microtime(), 2, 6 );
 
 	$file_attached = FileUpload(
 		$input,

programming_language: PHP