CVE-2022-0394: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-01-28T11:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhfaq/embedcode.tpl.php, lhc_web/design/defaulttheme/tpl/lhfaq/htmlcode.tpl.php, lhc_web/design/defaulttheme/tpl/lhquestionary/embedcode.tpl.php
Commit date: 2022-01-27 14:58:08 -0500
Commit message: Escape for angular in embed pages

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhfaq/embedcode.tpl.php b/lhc_web/design/defaulttheme/tpl/lhfaq/embedcode.tpl.php
index b200b1caa45..b2cc3739bc1 100644
--- a/lhc_web/design/defaulttheme/tpl/lhfaq/embedcode.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhfaq/embedcode.tpl.php
@@ -1,8 +1,8 @@
 <h1><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/htmlcode','HTML code');?></h1>
 
-<div class="row">
+<div class="row" ng-non-bindable>
 	<div class="col-md-6">
 		<div class="form-group">
 			<label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/htmlcode','Choose a language');?></label> <select id="LocaleID" class="form-control">
             <?php foreach ($locales as $locale ) : ?>
             <option value="<?php echo $locale?>/"><?php echo $locale?></option>
diff --git a/lhc_web/design/defaulttheme/tpl/lhfaq/htmlcode.tpl.php b/lhc_web/design/defaulttheme/tpl/lhfaq/htmlcode.tpl.php
index 127a62c2c5e..637b6e5c3b7 100644
--- a/lhc_web/design/defaulttheme/tpl/lhfaq/htmlcode.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhfaq/htmlcode.tpl.php
@@ -22,11 +22,11 @@
 			</div>
 		</div>
 	</div>
 </div>
 
-<div class="row">
+<div class="row" ng-non-bindable>
 	<div class="col-md-6">
 		<div class="form-group">
 			<label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/htmlcode','Choose a language');?></label> <select id="LocaleID" class="form-control">
             <?php foreach ($locales as $locale ) : ?>
             <option value="<?php echo $locale?>/"><?php echo $locale?></option>
diff --git a/lhc_web/design/defaulttheme/tpl/lhquestionary/embedcode.tpl.php b/lhc_web/design/defaulttheme/tpl/lhquestionary/embedcode.tpl.php
index cc5ce63d004..d19cc71511f 100644
--- a/lhc_web/design/defaulttheme/tpl/lhquestionary/embedcode.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhquestionary/embedcode.tpl.php
@@ -1,11 +1,11 @@
 <h1><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/htmlcode','HTML code');?></h1>
 
 <div class="row">
     <div class="col-md-6">
         <label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/htmlcode','Choose a language');?></label>
-        <select class="form-control" id="LocaleID">
+        <select class="form-control" id="LocaleID" ng-non-bindable>
             <?php foreach ($locales as $locale ) : ?>
             <option value="<?php echo $locale?>/"><?php echo $locale?></option>
             <?php endforeach; ?>
         </select>
     </div>
@@ -17,11 +17,11 @@
 		            <option value="https:">https:</option>      
 		    </select>    	    
     </div>
     <div class="col-md-6 end">
     	<label><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/htmlcode','Theme')?></label>
-        <select class="form-control" id="ThemeID">
+        <select class="form-control" id="ThemeID" ng-non-bindable>
         	<option value="0"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('system/htmlcode','Default');?></option>
 			<?php foreach (erLhAbstractModelWidgetTheme::getList(array('limit' => 1000)) as $theme) : ?>
 			   <option value="<?php echo $theme->id?>"><?php echo htmlspecialchars($theme->name)?></option>
 			<?php endforeach; ?>
 		</select>

Vulnerable code: <div class="row">
<div class="row">
        <select class="form-control" id="LocaleID">
        <select class="form-control" id="ThemeID">
Fixed code: <div class="row" ng-non-bindable>
<div class="row" ng-non-bindable>
        <select class="form-control" id="LocaleID" ng-non-bindable>
        <select class="form-control" id="ThemeID" ng-non-bindable>