CVE-2017-6905: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (disable_choose) passed to the "concrete5-legacy-master/web/concrete/tools/files/search_dialog.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-15T00:59Z
Repository: https://github.com/concrete5/concrete5-legacy
Language: PHP
Files changed: web/concrete/tools/files/search_dialog.php
Commit date: 2017-03-13 14:05:40 -0400
Commit message: Fix #1947
Diff: diff --git a/web/concrete/tools/files/search_dialog.php b/web/concrete/tools/files/search_dialog.php
index 58dfdf042..119f2d2aa 100644
--- a/web/concrete/tools/files/search_dialog.php
+++ b/web/concrete/tools/files/search_dialog.php
@@ -11,20 +11,21 @@ if (isset($_REQUEST['searchInstance'])) {
 	$searchInstance = Loader::helper('text')->entities($_REQUEST['searchInstance']);
 } else {
 	$searchInstance = $page . time();
 }
 $ocID = Loader::helper('text')->entities($_REQUEST['ocID']);
+$disable_choose = Loader::helper('text')->entities($_REQUEST['disable_choose']);
 
 $cnt = Loader::controller('/dashboard/files/search');
 $fileList = $cnt->getRequestedSearchResults();
 $files = $fileList->getPage();
 $pagination = $fileList->getPagination();
 $searchRequest = $cnt->get('searchRequest');
 $columns = $cnt->get('columns');
 
 $alType = 'false';
-if (isset($_REQUEST['disable_choose']) && $_REQUEST['disable_choose'] == 1) { 
+if ($disable_choose == 1) { 
 	$alType = 'BROWSE';
 }
 
 ob_start();
 Loader::element('files/search_results', array('ocID' => $ocID, 'searchInstance' => $searchInstance, 'searchRequest' => $searchRequest, 'columns' => $columns, 'searchType' => 'DIALOG', 'files' => $files, 'fileList' => $fileList)); $searchForm = ob_get_contents();
@@ -38,11 +39,11 @@ $v->outputHeaderItems();
 
 <? if (!isset($_REQUEST['refreshDialog'])) { ?> 
 	<div id="ccm-<?=$searchInstance?>-overlay-wrapper">
 <? } ?>
 <div id="ccm-<?=$searchInstance?>-search-overlay" class="ccm-ui">
-	<input type="hidden" name="dialogAction" value="<?=REL_DIR_FILES_TOOLS_REQUIRED?>/files/search_dialog?ocID=<?=$_REQUEST['ocID']?>&searchInstance=<?=$searchInstance?>&disable_choose=<?=$_REQUEST['disable_choose']?>" />
+	<input type="hidden" name="dialogAction" value="<?=REL_DIR_FILES_TOOLS_REQUIRED?>/files/search_dialog?ocID=<?=$ocID?>&amp;searchInstance=<?=$searchInstance?>&amp;disable_choose=<?=$disable_choose?>" />
 
 <div class="ccm-pane-options" id="ccm-<?=$searchInstance?>-pane-options">
 
 <div class="ccm-file-manager-search-form"><? Loader::element('files/search_form_advanced', array('searchInstance' => $searchInstance, 'searchRequest' => $searchRequest, 'searchType' => 'DIALOG')); ?></div>
 </div>
@@ -58,6 +59,6 @@ $v->outputHeaderItems();
 print '<script type="text/javascript">
 $(function() {
 	ccm_activateFileManager(\'' . $alType . '\', \'' . $searchInstance . '\');
 });
 </script>';
-?>
\ No newline at end of file
+?>

Vulnerable code: if (isset($_REQUEST['disable_choose']) && $_REQUEST['disable_choose'] == 1) { 
	<input type="hidden" name="dialogAction" value="<?=REL_DIR_FILES_TOOLS_REQUIRED?>/files/search_dialog?ocID=<?=$_REQUEST['ocID']?>&searchInstance=<?=$searchInstance?>&disable_choose=<?=$_REQUEST['disable_choose']?>" />
?>
Fixed code: $disable_choose = Loader::helper('text')->entities($_REQUEST['disable_choose']);
if ($disable_choose == 1) { 
	<input type="hidden" name="dialogAction" value="<?=REL_DIR_FILES_TOOLS_REQUIRED?>/files/search_dialog?ocID=<?=$ocID?>&amp;searchInstance=<?=$searchInstance?>&amp;disable_choose=<?=$disable_choose?>" />
?>