CVE-2023-0790 (published 2023-02-12T14:15Z)

Uncaught Exception in GitHub repository thorsten/phpmyfaq prior to 3.1.11.\n\n

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-248
cwe_name: Uncaught Exception
description: An exception is thrown from a function, but it is not caught.
extended_description: When an exception is not caught, it may cause the program to crash or expose sensitive information.
         

Fix information:
repo_url: https://github.com/thorsten/phpmyfaq
commit_details: repo_url: https://github.com/thorsten/phpmyfaq
author: Thorsten Rinne
author_date: 2023-01-25 08:11:21+01:00
msg: fix: added missing check on email address
repository: repo_url: https://github.com/thorsten/phpmyfaq
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: user.php
change_type: ModificationType.MODIFY
diff: @@ -114,41 +114,46 @@ if (
             $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_user_error_noId']);
         } else {
             $userData = [];
-            $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_UNSAFE_RAW, '');
-            $userData['email'] = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL, '');
-            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW, '');
+            $userData['display_name'] = Filter::filterInput(INPUT_POST, 'display_name', FILTER_UNSAFE_RAW);
+            $userData['email'] = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
+            $userData['last_modified'] = Filter::filterInput(INPUT_POST, 'last_modified', FILTER_UNSAFE_RAW);
             $userStatus = Filter::filterInput(INPUT_POST, 'user_status', FILTER_UNSAFE_RAW, $defaultUserStatus);
             $isSuperAdmin = Filter::filterInput(INPUT_POST, 'is_superadmin', FILTER_UNSAFE_RAW);
             $isSuperAdmin = $isSuperAdmin === 'on';
 
-            $user = new User($faqConfig);
-            $user->getUserById($userId, true);
+            // Sanity check
+            if (is_null($userData['email'])) {
+                $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['err_noMailAdress']);
+            } else {
+                $user = new User($faqConfig);
+                $user->getUserById($userId, true);
 
-            $stats = $user->getStatus();
+                $stats = $user->getStatus();
 
-            // set new password an send email if user is switched to active
-            if ($stats == 'blocked' && $userStatus == 'active') {
-                if (!$user->activateUser()) {
-                    $userStatus = 'invalid_status';
+                // set new password an send email if user is switched to active
+                if ($stats == 'blocked' && $userStatus == 'active') {
+                    if (!$user->activateUser()) {
+                        $userStatus = 'invalid_status';
+                    }
                 }
-            }
-
-            // Set super-admin flag
-            $user->setSuperAdmin($isSuperAdmin);
 
-            if (
-                !$user->userdata->set(array_keys($userData), array_values($userData)) ||
-                !$user->setStatus($userStatus)
-            ) {
-                $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_msg_mysqlerr']);
-            } else {
-                $message .= sprintf(
-                    '<p class="alert alert-success">%s <strong>%s</strong> %s</p>',
-                    $PMF_LANG['ad_msg_savedsuc_1'],
-                    Strings::htmlentities($user->getLogin(), ENT_QUOTES),
-                    $PMF_LANG['ad_msg_savedsuc_2']
-                );
-                $message .= '<script>updateUser(' . $userId . ');</script>';
+                // Set super-admin flag
+                $user->setSuperAdmin($isSuperAdmin);
+
+                if (
+                    !$user->userdata->set(array_keys($userData), array_values($userData)) ||
+                    !$user->setStatus($userStatus)
+                ) {
+                    $message .= sprintf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_msg_mysqlerr']);
+                } else {
+                    $message .= sprintf(
+                        '<p class="alert alert-success">%s <strong>%s</strong> %s</p>',
+                        $PMF_LANG['ad_msg_savedsuc_1'],
+                        Strings::htmlentities($user->getLogin(), ENT_QUOTES),
+                        $PMF_LANG['ad_msg_savedsuc_2']
+                    );
+                    $message .= '<script>updateUser(' . $userId . ');</script>';
+                }
             }
         }
     }

programming_language: PHP