Possible file inclusion vulnerability

[enferas]

Hello,

I would like to report for possible file inclusion vulnerability.

In file "web/add/user/index.php"

// line 86
// the source
$subject = _translate($_POST['v_language'],"Welcome to Vesta Control Panel");

File web/inc/i18n.php

// line 9
function _translate() {
// ...
$args = func_get_args();
$l = $args[0];
// ...
// the sink with file inclusion with $l
require_once($_SERVER['DOCUMENT_ROOT']."/inc/i18n/$l.php");

// ...
}

[dpeca]

@enferas what we should write in Changelog as Credits?
Credits to @enferas ?

[enferas]

@dpeca Thank you for confirming my report.
If it is okay for you. I would like to gain a CVE for my discovery.
Should I contact CVE Mite then they contact you ? or you prefer to contact them directly?

[enferas]

CVE-2021-43693 is assigned.

vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.