CVE-2019-9002 (published 2019-02-22T07:29Z)

An issue was discovered in Tiny Issue 1.3.1 and pixeline Bugs through 1.3.2c. install/config-setup.php allows remote attackers to execute arbitrary PHP code via the database_host parameter if the installer remains present in its original directory after installation is completed.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/pixeline/bugs
commit_details: repo_url: https://github.com/pixeline/bugs
author: Patriboom
author_date: 2019-02-20 09:08:03-05:00
msg: config-setup deleted after install ... safety concern
repository: repo_url: https://github.com/pixeline/bugs
repo_name: pixeline/bugs
description: Simple Issue Tracking for Teams. Built in Laravel 3 (php/mysql)
repo_language: PHP
owner: pixeline
file_changes: filename: config-setup.php
change_type: ModificationType.MODIFY
diff: @@ -79,7 +79,7 @@ if(isset($_POST['create_config']) && isset($_POST['database_host'])) {
 	}
 	//From the freshly made mysql-structure.php file, we'll create tables and default data along the install.php process
 	require "./install.php";
-	$install = new install();
+	$install = new install();
 	$database_check = $install->check_connect();
 	$install->config = require '../config.app.php';
 	$install->create_database($_POST);
@@ -219,7 +219,16 @@ if(!file_exists('../config.app.php')){ ?>
 			<tr>
 				<th><?php echo $MyLng['Email_port']; ?></th>
 				<td>
-					<input type="text" name="email_port" value="" placeholder="default: 25; gmail: 587" />
+					<select name="email_port">
+					<option value="25"> 25 (default)</option>
+					<option value="587">587 (gmail)</option>
+					<option value="465">465 (SSL / TLS)</option>
+					<?php
+						for ($x=1; $x<999; $x++) {
+							echo '<option value="'.$x.'">'.$x.'</option>';
+						}
+					?>
+					</select>
 				</td>
 			</tr>
 			<tr>
@@ -253,21 +262,22 @@ if(!file_exists('../config.app.php')){ ?>
 				<th><?php echo $MyLng['Time_Timezone']; ?></th>
 				<td>
 					<select name="timezone">
-<?php
-$timezones = timezone_identifiers_list();
-
-echo 'select name="timezone" size="10">' . "\n";
-
-foreach($timezones as $timezone)
-{
-  echo '<option';
-  echo $timezone == 'Europe/Brussels' ? ' selected' : '';
-  echo '>' . $timezone . '</option>' . "\n";
-}
-
-echo '</select>' . "\n";
-?>
-						</select>
+						<?php
+						$timezones = timezone_identifiers_list();
+						
+						echo 'select name="timezone" size="10">' . "\n";
+						
+						foreach($timezones as $timezone)
+						{
+						  echo '<option';
+//						  echo $timezone == 'Europe/Brussels' ? ' selected' : '';
+						  echo $timezone == date("e") ? ' selected' : '';
+						  echo '>' . $timezone . '</option>' . "\n";
+						}
+						
+						echo '</select>' . "\n";
+						?>
+					</select>
 					</td>
 				</tr>
 				<tr>

programming_language: PHP
filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,15 @@ include_once "../app/application/language/all.php";
 $EnLng = require_once("../app/application/language/en/install.php");
 if (!isset($_GET["Lng"]) || !file_exists("../app/application/language/".@$_GET["Lng"]."/install.php")) { $_GET["Lng"] = 'en'; }
 if (@$_GET["Lng"] != 'en' ) { $MyLng = require_once("../app/application/language/".$_GET["Lng"]."/install.php"); $MyLng = array_merge($EnLng, $MyLng); } else {$MyLng = $EnLng; }
-require './config-setup.php';
+if (!file_exists('./config-setup.php')) {
+	echo '<script>';
+	echo 'alert("Install already has been proceessed");';
+	echo 'document.location.href="../index.php";';
+	echo '</script>';
+	die();
+} else {
+	require './config-setup.php';
+}
 require '../app/laravel/hash.php';
 require '../app/laravel/str.php';
 
@@ -30,7 +38,8 @@ if(!$database_check['error']) {
 				$_SESSION["Msg"] .= '<p style="color: #060;">'.$MyLng['Complete_presentation'].'</p>';
 				$_SESSION["usr"] = $_POST['email'];  
 				$_SESSION["psw"] = $_POST['password'];  
-				//header('location: complete.php?Lng=fr');
+				//header('location: complete.php?Lng=fr');
+				unlink ("./config-setup.php");
 				header('location: ../');
 				die();
 			}

programming_language: PHP