CVE-2023-25655 (published 2023-03-23T20:15Z)

baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/baserproject/basercms
commit_details: repo_url: https://github.com/baserproject/basercms
author: gondoh
author_date: 2023-02-27 15:13:19+09:00
msg: fix CVE-2023-25655

validation errorが発生してもファイルを保存してしまう処理の改善
repository: repo_url: https://github.com/baserproject/basercms
repo_name: baserproject/basercms
description: baserCMS :  Based Website Development Project
repo_language: PHP
owner: baserproject
file_changes: filename: BcUploadBehavior.php
change_type: ModificationType.MODIFY
diff: @@ -101,15 +101,20 @@ class BcUploadBehavior extends ModelBehavior
 	 *
 	 * @param Model $Model
 	 * @param array $options
-	 * @return mixed
+	 * @return void
 	 */
 	public function afterValidate(Model $Model, $options = [])
 	{
-		if($this->validatingLock[$Model->alias]) return true;
-        $Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupRequestData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
-        $Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupTmpData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
-        $this->oldEntity[$Model->alias] = (!empty($Model->data[$Model->alias]['id']))? $this->getOldEntity($Model, $Model->data[$Model->alias]['id']) : [];
-        $this->validatingLock[$Model->alias] = true;
+		if ($Model->validationErrors) {
+			return;
+		}
+		if ($this->validatingLock[$Model->alias]) {
+			return;
+		}
+		$Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupRequestData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
+		$Model->data[$Model->alias] = $this->BcFileUploader[$Model->alias]->setupTmpData(isset($Model->data[$Model->alias])? $Model->data[$Model->alias] : $Model->data);
+		$this->oldEntity[$Model->alias] = (!empty($Model->data[$Model->alias]['id']))? $this->getOldEntity($Model, $Model->data[$Model->alias]['id']) : [];
+		$this->validatingLock[$Model->alias] = true;
 
 		// @deprecated 後方互換 since v4.5.6, v5.0.0 で削除予定
 		// CuApprover-4.3.2以下に対応するための処理
@@ -133,8 +138,6 @@ class BcUploadBehavior extends ModelBehavior
 			}
 		}
 		// <<<
-
-        return true;
 	}
 
 	/**

programming_language: PHP
repo_url: https://github.com/baserproject/basercms
commit_details: repo_url: https://github.com/baserproject/basercms
author: ゴンドー
author_date: 2023-03-23 16:14:44+09:00
msg: Merge pull request from GHSA-mfvg-qwcw-qvc8

fix CVE-2023-25655
repository: repo_url: https://github.com/baserproject/basercms
repo_name: baserproject/basercms
description: baserCMS :  Based Website Development Project
repo_language: PHP
owner: baserproject