CVE-2022-0253: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-17T14:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhviews/loadview.tpl.php, lhc_web/design/defaulttheme/tpl/lhviews/save_chat_view.tpl.php, lhc_web/design/defaulttheme/tpl/lhwebhooks/edit.tpl.php, lhc_web/design/defaulttheme/tpl/lhwebhooks/editincoming.tpl.php
Commit date: 2022-01-17 06:59:53 -0500
Commit message: Do not execute angular title

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhviews/loadview.tpl.php b/lhc_web/design/defaulttheme/tpl/lhviews/loadview.tpl.php
index 98d0789c805..7e8f83a6c9e 100644
--- a/lhc_web/design/defaulttheme/tpl/lhviews/loadview.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhviews/loadview.tpl.php
@@ -1,10 +1,10 @@
 <?php if ($search->scope == 'chat') : ?>
     <?php if (!$list_mode) : ?>
     <div role="tabpanel" id="tabs" ng-cloak>
         <ul class="nav nav-pills" role="tablist">
-            <li role="presentation" class="nav-item"><a class="nav-link active" href="#chatlist" aria-controls="chatlist" role="tab" data-toggle="tab" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Chat list');?>">
+            <li role="presentation" class="nav-item"><a class="nav-link active" href="#chatlist" aria-controls="chatlist" ng-non-bindable role="tab" data-toggle="tab" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Chat list');?>">
                     <?php echo htmlspecialchars($search->name)?> </a>
             </li>
         </ul>
         <div class="tab-content" ng-cloak>
             <div role="tabpanel" class="tab-pane form-group active" id="chatlist">
diff --git a/lhc_web/design/defaulttheme/tpl/lhviews/save_chat_view.tpl.php b/lhc_web/design/defaulttheme/tpl/lhviews/save_chat_view.tpl.php
index 2377fafb9b1..9a005c6d29d 100644
--- a/lhc_web/design/defaulttheme/tpl/lhviews/save_chat_view.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhviews/save_chat_view.tpl.php
@@ -7,11 +7,11 @@ $appendPrintExportURL = '';
 ?>
 <?php include(erLhcoreClassDesign::designtpl('lhkernel/modal_header.tpl.php'));?>
 
 <?php include(erLhcoreClassDesign::designtpl('lhchat/lists/search_panel_append_print_multiinclude.tpl.php'));?>
 
-    <form action="<?php echo htmlspecialchars($action_url)?>/(export)/2?<?php echo $appendPrintExportURL?>" method="post" target="_blank" onsubmit="return lhinst.submitModalForm($(this))">
+    <form action="<?php echo htmlspecialchars($action_url)?>/(export)/2?<?php echo $appendPrintExportURL?>" method="post" ng-non-bindable target="_blank" onsubmit="return lhinst.submitModalForm($(this))">
 
         <?php if (isset($errors)) : ?>
             <?php include(erLhcoreClassDesign::designtpl('lhkernel/validation_error.tpl.php'));?>
         <?php endif; ?>
         
diff --git a/lhc_web/design/defaulttheme/tpl/lhwebhooks/edit.tpl.php b/lhc_web/design/defaulttheme/tpl/lhwebhooks/edit.tpl.php
index fcdbdc7fd59..aef39d5c76a 100644
--- a/lhc_web/design/defaulttheme/tpl/lhwebhooks/edit.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhwebhooks/edit.tpl.php
@@ -1,6 +1,6 @@
-<h1><?php echo htmlspecialchars($item->name)?></h1>
+<h1 ng-non-bindable><?php echo htmlspecialchars($item->name)?></h1>
 
 <?php if (isset($errors)) : ?>
 	<?php include(erLhcoreClassDesign::designtpl('lhkernel/validation_error.tpl.php'));?>
 <?php endif; ?>
 
diff --git a/lhc_web/design/defaulttheme/tpl/lhwebhooks/editincoming.tpl.php b/lhc_web/design/defaulttheme/tpl/lhwebhooks/editincoming.tpl.php
index cff2330e558..4dbe1c2483e 100644
--- a/lhc_web/design/defaulttheme/tpl/lhwebhooks/editincoming.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhwebhooks/editincoming.tpl.php
@@ -1,6 +1,6 @@
-<h1><?php echo htmlspecialchars($item->name)?></h1>
+<h1 ng-non-bindable><?php echo htmlspecialchars($item->name)?></h1>
 
 <?php if (isset($errors)) : ?>
     <?php include(erLhcoreClassDesign::designtpl('lhkernel/validation_error.tpl.php'));?>
 <?php endif; ?>
 

Vulnerable code:             <li role="presentation" class="nav-item"><a class="nav-link active" href="#chatlist" aria-controls="chatlist" role="tab" data-toggle="tab" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Chat list');?>">
    <form action="<?php echo htmlspecialchars($action_url)?>/(export)/2?<?php echo $appendPrintExportURL?>" method="post" target="_blank" onsubmit="return lhinst.submitModalForm($(this))">
<h1><?php echo htmlspecialchars($item->name)?></h1>
<h1><?php echo htmlspecialchars($item->name)?></h1>
Fixed code:             <li role="presentation" class="nav-item"><a class="nav-link active" href="#chatlist" aria-controls="chatlist" ng-non-bindable role="tab" data-toggle="tab" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Chat list');?>">
    <form action="<?php echo htmlspecialchars($action_url)?>/(export)/2?<?php echo $appendPrintExportURL?>" method="post" ng-non-bindable target="_blank" onsubmit="return lhinst.submitModalForm($(this))">
<h1 ng-non-bindable><?php echo htmlspecialchars($item->name)?></h1>
<h1 ng-non-bindable><?php echo htmlspecialchars($item->name)?></h1>