Description

The add_domain() subroutine in maia_db.php does not check that the supplied domain name exists in the maia_domains table, and blindly INSERTs new rows. If a user tries to add a domain name more than once, repeated entries in the maia_domains and policy tables get created, and only the most recent version gets linked to the users table, orphaning the earlier versions. The maia_domains.domain column and the policy.policy_name table do not have any UNIQUE constraints, so no error is returned from the database driver.