CVE-2011-3598: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in phpPgAdmin before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) a web page title, related to classes/Misc.php; or the (2) return_url or (3) return_desc parameter to display.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2011-10-08T02:52Z
Repository: https://github.com/phppgadmin/phppgadmin
Language: PHP
Files changed: HISTORY, classes/Misc.php, display.php
Commit date: 2011-09-28 23:15:36 +0200
Commit message: Fix two security fix about XSS, reported by Mateusz Goik, fixed by ioguix.

Diff: diff --git a/HISTORY b/HISTORY
index 28a1b21..bf9f0f8 100644
--- a/HISTORY
+++ b/HISTORY
@@ -39,11 +39,11 @@ Bugs
 * Fix problems with query tracking on overly long queries
 * Ensure pg_dump paths are valid
 * Fix multiple bugs about quoting and escaping database objects names with special chars
 * Fix multiple bugs in the browser tree
 * Fix multiple bugs on the SQL and script file import form
-* One security fix about code injection
+* Three security fix about code injection
 * Don't allow inserting on a table without fields
 * Some fix about commenting databases
 * removed deprecated functions from PHP 5.3
 * Lot of code cleanup
 * Many other small minor bugs found on our way
diff --git a/classes/Misc.php b/classes/Misc.php
index 6a15c0d..3a04ddc 100644
--- a/classes/Misc.php
+++ b/classes/Misc.php
@@ -396,11 +396,11 @@
 				// Theme
 				echo "<link rel=\"stylesheet\" href=\"themes/{$conf['theme']}/global.css\" type=\"text/css\" />\n";
 				echo "<link rel=\"shortcut icon\" href=\"images/themes/{$conf['theme']}/Favicon.ico\" type=\"image/vnd.microsoft.icon\" />\n";
 				echo "<link rel=\"icon\" type=\"image/png\" href=\"images/themes/{$conf['theme']}/Introduction.png\" />\n";
 				echo "<title>", htmlspecialchars($appName);
-				if ($title != '') echo " - {$title}";
+				if ($title != '') echo htmlspecialchars(" - {$title}");
 				echo "</title>\n";
 
 				if ($script) echo "{$script}\n";
 				echo "</head>\n";
 			}
diff --git a/display.php b/display.php
index c36739a..b7a31ce 100644
--- a/display.php
+++ b/display.php
@@ -576,11 +576,11 @@
 		// Navigation links	
 		echo "<ul class=\"navlink\">\n";
 
 		// Return
 		if (isset($_REQUEST['return_url']) && isset($_REQUEST['return_desc']))
-			echo "\t<li><a href=\"{$_REQUEST['return_url']}\">{$_REQUEST['return_desc']}</a></li>\n";
+			echo "\t<li><a href=\"". htmlspecialchars($_REQUEST['return_url']) ."\">". htmlspecialchars($_REQUEST['return_desc']) ."</a></li>\n";
 
 		// Edit SQL link
 		if (isset($_REQUEST['query']))
 			echo "\t<li><a href=\"database.php?{$misc->href}&amp;action=sql&amp;paginate=on&amp;query=",
 				urlencode($_REQUEST['query']), "\">{$lang['streditsql']}</a></li>\n";

Vulnerable code: * One security fix about code injection
				if ($title != '') echo " - {$title}";
			echo "\t<li><a href=\"{$_REQUEST['return_url']}\">{$_REQUEST['return_desc']}</a></li>\n";
Fixed code: * Three security fix about code injection
				if ($title != '') echo htmlspecialchars(" - {$title}");
			echo "\t<li><a href=\"". htmlspecialchars($_REQUEST['return_url']) ."\">". htmlspecialchars($_REQUEST['return_desc']) ."</a></li>\n";