CVE-2024-24572 (published 2024-01-31T23:15Z)

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $_REQUEST global array was unsafely called inside an extract() function in admin-logs.php. The PHP file fm-init.php prevents arbitrary manipulation of $_SESSION via the GET/POST parameters. However, it does not prevent manipulation of any other sensitive variables such as $search_sql. Knowing this, an authenticated user with privileges to view site logs can manipulate the search_sql\nvariable by appending a GET parameter search_sql in the URL. The information above means that the checks and SQL injection prevention attempts were rendered unusable.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/WillyXJ/facileManager
commit_details: repo_url: https://github.com/WillyXJ/facileManager
author: WillyXJ
author_date: 2024-01-30 13:26:16-07:00
msg: fM - #599 - Multiple security fixes
repository: repo_url: https://github.com/WillyXJ/facileManager
repo_name: WillyXJ/facileManager
description: A modular suite of web apps built with the sysadmin in mind.
repo_language: PHP
owner: WillyXJ
file_changes: filename: version.php
change_type: ModificationType.MODIFY
diff: @@ -24,7 +24,7 @@
  *
  * @global string $fm_version
  */
-$fm_version = '4.5.0';
+$fm_version = '4.5.1';
 
 /**
  * Holds the facileManager DB revision, increments when changes are made to the facileManager DB schema.

programming_language: PHP
filename: change.log
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,9 @@
+4.5.1 (2024-01-30)
+==================
+* Server - [security] Fixed authenticated variable manipulation leading to SQL Injection. (Issue #599)
+* Server - [security] Fixed privilege escalation via mass assignment. (Issue #599)
+* Server - [security] Fixed systemic cross-site scripting (XSS). (Issue #599)
+
 4.5.0 (2023-04-19)
 ==================
 * Server - [improvement] The settings now displays the timestamp of the last software update check.

programming_language: Markdown
filename: class_logins.php
change_type: ModificationType.MODIFY
diff: @@ -262,7 +262,7 @@ class fm_login {
 		if ($auth_method) {
 			/** Use Builtin Auth when Default Auth Method is LDAP but user is defined with 'facileManager/Builtin' */
 			$result = $fmdb->query("SELECT * FROM `fm_users` WHERE `user_login` = '$user_login' and `user_auth_type`=1 and `user_status`='active'");
-			if (is_array($fmdb->last_result) && $fmdb->last_result[0]->user_login == $user_login) {
+			if (isset($fmdb->last_result) && is_array($fmdb->last_result) && $fmdb->last_result[0]->user_login == $user_login) {
 				$auth_method = 1;
 			}
 

programming_language: PHP
filename: class_users.php
change_type: ModificationType.MODIFY
diff: @@ -253,8 +253,11 @@ class fm_users {
 		$post['user_id'] = (!isset($post['user_id']) || !$post['user_id']) ? $_SESSION['user']['id'] : intval($post['user_id']);
 
 		/** Authorized to update users? */
-		if ((!currentUserCan('manage_users') && $_SESSION['user']['id'] != $post['user_id']) || isset($post['user_login'])) {
-			return _('You do not have permission to make these changes.');
+		if ((!currentUserCan('manage_users') && ($_SESSION['user']['id'] != $post['user_id'] || isset($post['user_caps']))) 
+			|| ($_SESSION['user']['id'] != $post['user_id'] && $post['user_id'] == getDefaultAdminID()) 
+			|| isset($post['user_login'])
+			|| (isset($post['user_caps']) && $_SESSION['user']['id'] == $post['user_id'] && $_SESSION['user']['id'] == getDefaultAdminID())) {
+				return _('You do not have permission to make these changes.');
 		}
 
 		if (!empty($post['user_password'])) {

programming_language: PHP
filename: functions.php
change_type: ModificationType.MODIFY
diff: @@ -216,11 +216,12 @@ function sanitize($data, $replace = null) {
 
 		$data = str_replace($strip_chars, '', $data);
 		$data = str_replace($replace_chars, $replace, $data);
-		$data = str_replace('--', '-', $data);
+		$data = str_replace($replace . $replace, $replace, $data);
 		
 		return $data;
 	} else {
 		if (is_string($data)) {
+			$data = htmlspecialchars(strip_tags($data), ENT_NOQUOTES);
 			if ($fmdb->use_mysqli) {
 				return @mysqli_real_escape_string($fmdb->dbh, $data);
 			} else {

programming_language: PHP
filename: admin-logs.php
change_type: ModificationType.MODIFY
diff: @@ -28,8 +28,8 @@ printHeader();
 
 $response = isset($response) ? $response : null;
 
-$search_sql = $list = $log_search_query = $log_search_date_b = $log_search_date_e = null;
 extract($_REQUEST);
+$search_sql = null;
 
 /** Module search */
 if (isset($log_search_module) && is_array($log_search_module) && !in_array('All Modules', $log_search_module)) {
@@ -37,7 +37,6 @@ if (isset($log_search_module) && is_array($log_search_module) && !in_array('All
 }
 /** User search */
 $default_timezone = getOption('timezone', $_SESSION['user']['account_id']);
-$list = null;
 if (isset($log_search_user) && is_array($log_search_user) && !in_array('0', $log_search_user)) {
 	$search_sql .= 'AND user_login IN ("' . join('","', $log_search_user) . '") ';
 }

programming_language: PHP