CVE-2022-2714 (published 2022-09-06T11:15Z)

Improper Handling of Length Parameter Inconsistency in GitHub repository francoisjacquet/rosariosis prior to 10.0.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-130
cwe_name: Improper Handling of Length Parameter Inconsistency
description: The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
extended_description: If an attacker can manipulate the length parameter associated with an input such that it is inconsistent with the actual length of the input, this can be leveraged to cause the target application to behave in unexpected, and possibly, malicious ways. One of the possible motives for doing so is to pass in arbitrarily large input to the application. Another possible motivation is the modification of application state by including invalid data for subsequent properties of the application. Such weaknesses commonly lead to attacks such as buffer overflows and execution of arbitrary code.
         

Fix information:
repo_url: https://github.com/francoisjacquet/rosariosis
commit_details: repo_url: https://github.com/francoisjacquet/rosariosis
author: François Jacquet
author_date: 2022-08-05 18:05:23+02:00
msg: Limit $_POST array size to a maximum of 16MB
repository: repo_url: https://github.com/francoisjacquet/rosariosis
repo_name: francoisjacquet/rosariosis
description: RosarioSIS Student Information System for school management.
repo_language: PHP
owner: francoisjacquet
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -94,6 +94,7 @@ Changes in 10.0
 - MySQL use LONGTEXT type for textarea field in Fields.fnc.php & DisciplineForm.php
 - SQL Check requested assignment belongs to teacher in Assignments.php
 - CSS fix responsive when really long string with no space in stylesheet.css
+- Limit `$_POST` array size to a maximum of 16MB in Warehouse.php
 
 Changes in 9.3.1
 ----------------

programming_language: PHP
filename: Warehouse.php
change_type: ModificationType.MODIFY
diff: @@ -286,6 +286,50 @@ function array_rwalk( &$array, $function )
 	}
 }
 
+/**
+ * Limit $_POST array size to a maximum of 16MB
+ *
+ * $_POST array size is limited by PHP post_max_size configuration option
+ * But this includes $_FILES as well & post_max_size must be greater than upload_max_filesize
+ * One may want to be able to upload a 100MB file, but may not want the $_POST var,
+ * with for example the text or HTML of a textarea to be 100MB and later stored in database.
+ */
+if ( ! defined( 'ROSARIO_POST_MAX_SIZE_LIMIT' ) )
+{
+	/**
+	 * Fix a limit of 16MB based on MySQL max_allowed_packet default limit
+	 * Limit size can be overriden in the config.inc.php file
+	 */
+	define( 'ROSARIO_POST_MAX_SIZE_LIMIT', 16 * 1024 * 1024 ); // 16MB in bytes.
+}
+
+if ( $_POST
+	&& strlen( serialize( $_POST ) ) > ROSARIO_POST_MAX_SIZE_LIMIT )
+{
+	$post_max_size_limit = function( $value ) {
+		if ( strlen( $value ) > ( ROSARIO_POST_MAX_SIZE_LIMIT / 4 ) )
+		{
+			// Reset value > limit / 4, or else we would send it in the HackingLog email!
+			return 'ROSARIO_POST_MAX_SIZE_LIMIT / 4 reached.';
+		}
+
+		return $value;
+	};
+
+	array_rwalk( $_POST, $post_max_size_limit );
+
+	array_rwalk( $_REQUEST, $post_max_size_limit );
+
+	require_once 'ProgramFunctions/HackingLog.fnc.php';
+
+	// Do not translate.
+	$error[] = 'You are submitting too much data: over the ' .
+		( ROSARIO_POST_MAX_SIZE_LIMIT / 1024 / 1024 ) .
+		'M limit. Try reducing the data you are submitting.';
+
+	HackingLog();
+}
+
 /**
  * Sanitize $_REQUEST array
  * ($_POST + $_GET)

programming_language: PHP