PT-2022-23160 · Unknown+1 · Silverwaregames.Io+1

Mesosoi · Published 2022-09-06 · Updated 2023-07-21 · CVE-2022-36072

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SilverwareGames.io versions 1.1.8 and prior

Description SilverwareGames.io is a social network for users to play video games online. Due to an unobvious feature of PHP, hashes generated by built-in functions and starting with the 0e symbols were being handled as zero multiplied with the e number, resulting in a hash value equal to 0. The issue was fixed by using === instead of == in comparisons, such as on sign in/sign up handlers.

Recommendations For versions 1.1.8 and prior, update to version 1.1.9 or later, which uses === instead of == in comparisons to resolve the issue. As a temporary workaround, consider modifying the comparison operators in the affected code to use === for stricter type checking, until a formal update can be applied.

Exploit

Fix

Weakness Enumeration

CWE-597

Related Identifiers

CVE-2022-36072

GHSA-W4WQ-7J4Q-J2FH

Affected Products

Php

Silverwaregames.Io

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36072.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-36072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36072 · Security Note
• https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-w4wq-7j4q-j2fh · Note
• https://t.me/cibsecurity/49374 · Telegram Post
• https://t.me/cvenotify/36040 · Telegram Post