| Package | Affected versions | Patched versions |
|---|---|---|
| miraheze/ts-portal | < 30 | 30 |
| tsportal | < 30 | 30 |
Conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports.
Creating a DPA report about another user and leaving the evidence field empty causes that report to look like the reported user self-requested deletion of their data. Ingenuine report is not distinguishable from a genuine one.
This can be prevented by disabling convertEmptyStringsToNull in the middleware, or by validating evidence in Http/Controllers/DPAController::store() to not be empty.
New DPA report -> Select "...someone who I suspect is under the age of 13" for the "The above username is..." field -> Add nothing to the "Evidence" field -> Submit
Potential unauthorized deletion of any arbitrary user's data both in the current system (TSPortal) and subsequent systems if actioned.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free