CVE-2023-1878: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-04-05T17:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/stat.adminlog.php
Commit date: 2023-02-16 07:26:54 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/stat.adminlog.php b/phpmyfaq/admin/stat.adminlog.php
index 092d5b3d22..2c8207c12b 100644
--- a/phpmyfaq/admin/stat.adminlog.php
+++ b/phpmyfaq/admin/stat.adminlog.php
@@ -33,11 +33,11 @@ if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token']
     $deleteLog = false;
 } else {
     $deleteLog = true;
 }
 
-if ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'adminlog' == $action) {
+if ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'adminlog' === $action) {
     $date = new Date($faqConfig);
     $perpage = 15;
     $pages = Filter::filterInput(INPUT_GET, 'pages', FILTER_VALIDATE_INT);
     $page = Filter::filterInput(INPUT_GET, 'page', FILTER_VALIDATE_INT, 1);
 
@@ -115,11 +115,11 @@ if ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'adminlog' ==
             <td><?= $loggingId ?></td>
             <td><?= $date->format(date('Y-m-d H:i', $loggingValue['time'])) ?></td>
             <td><?= Strings::htmlentities($user->getLogin()) ?></td>
             <td><?= $loggingValue['ip'] ?></td>
             <td><small><?php
-            $text = $loggingValue['text'];
+            $text = Strings::htmlentities($loggingValue['text']);
             $text = str_replace('Loginerror', $PMF_LANG['ad_log_lger'], $text);
             $text = str_replace('Session expired', $PMF_LANG['ad_log_sess'], $text);
             $text = str_replace('Useredit, ', $PMF_LANG['ad_log_edit'], $text);
             $text = str_replace('admin-save-new-faq', $PMF_LANG['ad_log_crsa'], $text);
             $text = str_replace('admin-add-faq', $PMF_LANG['ad_log_crea'], $text);
@@ -136,11 +136,11 @@ if ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'adminlog' ==
     ?>
     </tbody>
     </table>
 
     <?php
-} elseif ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'deleteadminlog' == $action && $deleteLog) {
+} elseif ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'deleteadminlog' === $action && $deleteLog) {
     if ($logging->delete()) {
         printf('<p class="alert alert-success">%s</p>', $PMF_LANG['ad_adminlog_delete_success']);
     } else {
         printf('<p class="alert alert-danger">%s</p>', $PMF_LANG['ad_adminlog_delete_failure']);
     }

Vulnerable code: if ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'adminlog' == $action) {
            $text = $loggingValue['text'];
} elseif ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'deleteadminlog' == $action && $deleteLog) {
Fixed code: if ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'adminlog' === $action) {
            $text = Strings::htmlentities($loggingValue['text']);
} elseif ($user->perm->hasPermission($user->getUserId(), 'adminlog') && 'deleteadminlog' === $action && $deleteLog) {