Description

During the comparisons of different variables, PHP will automatically convert the data into a common, comparable type. This makes it possible to compare the number 12 to the string '12' or check whether or not a string is empty by using a comparison like $string == True. This, however, leads to a variety of problems and might even cause security vulnerabilities.The use == and != of might cause type juggling at the affected code.
https://github.com/lirantal/daloradius/ is vulnerable to Use of Wrong Operator in String Comparison as shown below:

Proof of concept

Vuln variable: $newpassword = $_POST['newpassword'] $verifypassword = $_POST['verifypassword']
Snippet:

        $newPassword = $_POST['newpassword'];
        $verifyPassword = $_POST['verifypassword'];
        if ($newPassword == $verifyPassword) {

Payload

Set the first variable to
0e12345 and set the second value to
0e54321 Observe the comparision returns true.

Impact

This vulnerability is capable of authentication bypass via magic hash attack

References

https://www.netsparker.com/blog/web-security/php-type-juggling-vulnerabilities/
https://www.php.net/manual/en/language.operators.comparison.php