MathiasReker / blmvuln

Major Security Vulnerability on PrestaShop Websites - CVE-2022-31101
MIT License
41 stars 6 forks source link

Error #13

Closed PatriceVigier closed 1 year ago

PatriceVigier commented 1 year ago

PS 1.7.8.9 PHP 7.3

ContextErrorException in modules/blmvuln/src/domain/service/scanner/FilePermissions.php (line 105)

        if (empty($this->insecurePermissionFiles)) {
            return false;
        }
        foreach ($this->insecurePermissionFiles as $path) {
            chmod($path, is_dir($path) ? Config::DEFAULT_MODE_FOLDER : Config::DEFAULT_MODE_FILES);
        }
        return true;
    }

it cannot change the file or folder permission

stack trace

ContextErrorException

  -- Symfony\Component\Debug\Exception\ContextErrorException: Warning: chmod(): Operation not permitted at modules/blmvuln/src/domain/service/scanner/FilePermissions.php:105 at PrestaShop\Module\BlmVuln\domain\service\scanner\FilePermissions->fix() (modules/blmvuln/controllers/admin/AdminBlmVulnController.php:74) at AdminBlmVulnController->fixVulnerabilities() (modules/blmvuln/controllers/admin/AdminBlmVulnController.php:41) at AdminBlmVulnController->renderList() (classes/controller/AdminController.php:2211) at AdminControllerCore->initContent() (classes/controller/Controller.php:306) at ControllerCore->run() (classes/Dispatcher.php:525) at DispatcherCore->dispatch() (zadmin/index.php:93)
MathiasReker commented 1 year ago

The problem is that your server does not allow php to use chmod()

PatriceVigier commented 1 year ago

Hello, Thank you for your answer It is what I thought and there is nothing I can do excepted to open writing to anyone, which will be a security problem! Sincerely