CVE-2023-0880 (published 2023-02-17T03:15Z)

Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.\n\n

CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-115
cwe_name: Misinterpretation of Input
description: The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/thorsten/phpmyfaq
commit_details: repo_url: https://github.com/thorsten/phpmyfaq
author: Thorsten Rinne
author_date: 2023-01-27 18:02:47+01:00
msg: fix: added trim to avoid questions with a single space
repository: repo_url: https://github.com/thorsten/phpmyfaq
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: ajaxservice.php
change_type: ModificationType.MODIFY
diff: @@ -317,21 +317,21 @@ switch ($action) {
         $category = new Category($faqConfig);
         $questionObject = new Question($faqConfig);
 
-        $author = Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW);
-        $email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
+        $author = trim(Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW));
+        $email = trim(Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL));
         $faqId = Filter::filterInput(INPUT_POST, 'faqid', FILTER_VALIDATE_INT);
         $faqLanguage = Filter::filterInput(INPUT_POST, 'lang', FILTER_UNSAFE_RAW);
         $question = Filter::filterInput(INPUT_POST, 'question', FILTER_UNSAFE_RAW);
-        $question = strip_tags($question);
+        $question = trim(strip_tags($question));
         if ($faqConfig->get('main.enableWysiwygEditorFrontend')) {
             $answer = Filter::filterInput(INPUT_POST, 'answer', FILTER_SANITIZE_SPECIAL_CHARS);
-            $answer = html_entity_decode($answer);
+            $answer = trim(html_entity_decode($answer));
         } else {
             $answer = Filter::filterInput(INPUT_POST, 'answer', FILTER_UNSAFE_RAW);
             $answer = strip_tags($answer);
-            $answer = nl2br($answer);
+            $answer = trim(nl2br($answer));
         }
-        $translatedAnswer = Filter::filterInput(INPUT_POST, 'translated_answer', FILTER_UNSAFE_RAW);
+        $translatedAnswer = trim(Filter::filterInput(INPUT_POST, 'translated_answer', FILTER_UNSAFE_RAW));
         $contentLink = Filter::filterInput(INPUT_POST, 'contentlink', FILTER_UNSAFE_RAW);
         $contentLink = Filter::filterVar($contentLink, FILTER_VALIDATE_URL);
         $keywords = Filter::filterInput(INPUT_POST, 'keywords', FILTER_UNSAFE_RAW);
@@ -478,11 +478,11 @@ switch ($action) {
         $faq = new Faq($faqConfig);
         $cat = new Category($faqConfig);
         $categories = $cat->getAllCategories();
-        $author = Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW);
-        $email = Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL);
+        $author = trim(Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW));
+        $email = trim(Filter::filterInput(INPUT_POST, 'email', FILTER_VALIDATE_EMAIL));
         $ucategory = Filter::filterInput(INPUT_POST, 'category', FILTER_VALIDATE_INT);
         $question = Filter::filterInput(INPUT_POST, 'question', FILTER_UNSAFE_RAW);
-        $question = strip_tags($question);
+        $question = trim(strip_tags($question));
         $save = Filter::filterInput(INPUT_POST, 'save', FILTER_VALIDATE_INT, 0);
 
         // If e-mail address is set to optional

programming_language: PHP