CVE-2022-0612: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-16T06:15Z
Repository: https://github.com/livehelperchat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/pagelayouts/parts/page_head_logo.tpl.php, lhc_web/design/defaulttheme/tpl/pagelayouts/parts/page_head_logo_back_office.tpl.php
Commit date: 2022-02-15 00:35:10 -0500
Commit message: Non bindable logo

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/page_head_logo.tpl.php b/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/page_head_logo.tpl.php
index 8f05cbbc1c9..ba5809c3620 100644
--- a/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/page_head_logo.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/page_head_logo.tpl.php
@@ -1 +1 @@
-<a rel="noreferrer" class="back-logo" href="<?php if (isset($Result['theme']) !== false && $Result['theme']->widget_copyright_url != '') : ?><?php echo htmlspecialchars($Result['theme']->widget_copyright_url) ?><?php else : ?><?php echo erLhcoreClassModelChatConfig::fetch('customer_site_url')->current_value?><?php endif;?>" target="_blank" title="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>"><img class="img-fluid" src="<?php if (isset($Result['theme']) && $Result['theme']->logo_image_url !== false) : ?><?php echo $Result['theme']->logo_image_url;?><?php else : ?><?php echo erLhcoreClassDesign::design('images/general/logo_user.png');?><?php endif;?>" alt="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>" title="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>"></a>
\ No newline at end of file
+<a ng-non-bindable rel="noreferrer" class="back-logo" href="<?php if (isset($Result['theme']) !== false && $Result['theme']->widget_copyright_url != '') : ?><?php echo htmlspecialchars($Result['theme']->widget_copyright_url) ?><?php else : ?><?php echo erLhcoreClassModelChatConfig::fetch('customer_site_url')->current_value?><?php endif;?>" target="_blank" title="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>"><img class="img-fluid" src="<?php if (isset($Result['theme']) && $Result['theme']->logo_image_url !== false) : ?><?php echo $Result['theme']->logo_image_url;?><?php else : ?><?php echo erLhcoreClassDesign::design('images/general/logo_user.png');?><?php endif;?>" alt="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>" title="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>"></a>
\ No newline at end of file
diff --git a/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/page_head_logo_back_office.tpl.php b/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/page_head_logo_back_office.tpl.php
index 8f7da887d8e..289cd920e72 100644
--- a/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/page_head_logo_back_office.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/pagelayouts/parts/page_head_logo_back_office.tpl.php
@@ -1 +1 @@
-<a rel="noreferrer" class="navbar-brand back-logo" href="<?php echo erLhcoreClassDesign::baseurl()?>" title="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>"><img class="img-fluid" src="<?php echo erLhcoreClassDesign::design('images/general/logo.png');?>" alt="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>" title="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>"></a>
\ No newline at end of file
+<a rel="noreferrer" ng-non-bindable class="navbar-brand back-logo" href="<?php echo erLhcoreClassDesign::baseurl()?>" title="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>"><img class="img-fluid" src="<?php echo erLhcoreClassDesign::design('images/general/logo.png');?>" alt="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>" title="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>"></a>
\ No newline at end of file

Vulnerable code: <a rel="noreferrer" class="back-logo" href="<?php if (isset($Result['theme']) !== false && $Result['theme']->widget_copyright_url != '') : ?><?php echo htmlspecialchars($Result['theme']->widget_copyright_url) ?><?php else : ?><?php echo erLhcoreClassModelChatConfig::fetch('customer_site_url')->current_value?><?php endif;?>" target="_blank" title="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>"><img class="img-fluid" src="<?php if (isset($Result['theme']) && $Result['theme']->logo_image_url !== false) : ?><?php echo $Result['theme']->logo_image_url;?><?php else : ?><?php echo erLhcoreClassDesign::design('images/general/logo_user.png');?><?php endif;?>" alt="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>" title="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>"></a>
<a rel="noreferrer" class="navbar-brand back-logo" href="<?php echo erLhcoreClassDesign::baseurl()?>" title="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>"><img class="img-fluid" src="<?php echo erLhcoreClassDesign::design('images/general/logo.png');?>" alt="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>" title="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>"></a>
Fixed code: <a ng-non-bindable rel="noreferrer" class="back-logo" href="<?php if (isset($Result['theme']) !== false && $Result['theme']->widget_copyright_url != '') : ?><?php echo htmlspecialchars($Result['theme']->widget_copyright_url) ?><?php else : ?><?php echo erLhcoreClassModelChatConfig::fetch('customer_site_url')->current_value?><?php endif;?>" target="_blank" title="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>"><img class="img-fluid" src="<?php if (isset($Result['theme']) && $Result['theme']->logo_image_url !== false) : ?><?php echo $Result['theme']->logo_image_url;?><?php else : ?><?php echo erLhcoreClassDesign::design('images/general/logo_user.png');?><?php endif;?>" alt="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>" title="<?php if (isset($Result['theme'])) : ?><?php echo htmlspecialchars($Result['theme']->name_company)?><?php else : ?><?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?><?php endif;?>"></a>
<a rel="noreferrer" ng-non-bindable class="navbar-brand back-logo" href="<?php echo erLhcoreClassDesign::baseurl()?>" title="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>"><img class="img-fluid" src="<?php echo erLhcoreClassDesign::design('images/general/logo.png');?>" alt="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>" title="<?php echo htmlspecialchars(erLhcoreClassModelChatConfig::fetch('customer_company_name')->current_value)?>"></a>