CVE-2015-7348: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to demo/en/asyncData/getNodesForBigData.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-12-07T20:59Z
Repository: https://github.com/zTree/zTree_v3
Language: PHP
Files changed: demo/cn/asyncData/getNodes.php, demo/cn/asyncData/getNodesForBigData.php, demo/en/asyncData/getNodes.php, demo/en/asyncData/getNodesForBigData.php
Commit date: 2015-11-25 19:07:32 -0800
Commit message: fix CVE-2015-7348

Diff: diff --git a/demo/cn/asyncData/getNodes.php b/demo/cn/asyncData/getNodes.php
index 55c3918..6d22b5e 100644
--- a/demo/cn/asyncData/getNodes.php
+++ b/demo/cn/asyncData/getNodes.php
@@ -19,15 +19,13 @@ if(array_key_exists('chk',$_REQUEST)) {
 if ($pId==null || $pId=="") $pId = "0";
 if ($pLevel==null || $pLevel=="") $pLevel = "0";
 if ($pName==null) $pName = "";
 else $pName = $pName.".";
 
-$pId = str_replace("%<%", "&lt;", $pId);
-$pId = str_replace("%>%", "&gt;", $pId);
+$pId = htmlspecialchars($pId);
 
-$pName = str_replace("%<%", "&lt;", $pName);
-$pName = str_replace("%>%", "&gt;", $pName);
+$pName = htmlspecialchars($pName);
 
 //for ($i=1; $i<9999; $i++) {
 //	for ($j=1; $j<999; $j++) {
 //
 //	}
diff --git a/demo/cn/asyncData/getNodesForBigData.php b/demo/cn/asyncData/getNodesForBigData.php
index f91098f..588c14c 100644
--- a/demo/cn/asyncData/getNodesForBigData.php
+++ b/demo/cn/asyncData/getNodesForBigData.php
@@ -9,12 +9,11 @@ if(array_key_exists( 'count',$_REQUEST)) {
 	$pCount=$_REQUEST['count'];
 }
 if ($pId==null || $pId=="") $pId = "0";
 if ($pCount==null || $pCount=="") $pCount = "10";
 
-$pId = str_replace("%<%", "&lt;", $pId);
-$pId = str_replace("%>%", "&gt;", $pId);
+$pId = htmlspecialchars($pId);
 
 $max = (int)$pCount;
 for ($i=1; $i<=$max; $i++) {
 	$nId = $pId."_".$i;
 	$nName = "tree".$nId;
@@ -22,6 +21,6 @@ for ($i=1; $i<=$max; $i++) {
 	if ($i<$max) {
 		echo ",";
 	}
 	
 }
-?>]
\ No newline at end of file
+?>]
diff --git a/demo/en/asyncData/getNodes.php b/demo/en/asyncData/getNodes.php
index 55c3918..6d22b5e 100644
--- a/demo/en/asyncData/getNodes.php
+++ b/demo/en/asyncData/getNodes.php
@@ -19,15 +19,13 @@ if(array_key_exists('chk',$_REQUEST)) {
 if ($pId==null || $pId=="") $pId = "0";
 if ($pLevel==null || $pLevel=="") $pLevel = "0";
 if ($pName==null) $pName = "";
 else $pName = $pName.".";
 
-$pId = str_replace("%<%", "&lt;", $pId);
-$pId = str_replace("%>%", "&gt;", $pId);
+$pId = htmlspecialchars($pId);
 
-$pName = str_replace("%<%", "&lt;", $pName);
-$pName = str_replace("%>%", "&gt;", $pName);
+$pName = htmlspecialchars($pName);
 
 //for ($i=1; $i<9999; $i++) {
 //	for ($j=1; $j<999; $j++) {
 //
 //	}
diff --git a/demo/en/asyncData/getNodesForBigData.php b/demo/en/asyncData/getNodesForBigData.php
index f91098f..588c14c 100644
--- a/demo/en/asyncData/getNodesForBigData.php
+++ b/demo/en/asyncData/getNodesForBigData.php
@@ -9,12 +9,11 @@ if(array_key_exists( 'count',$_REQUEST)) {
 	$pCount=$_REQUEST['count'];
 }
 if ($pId==null || $pId=="") $pId = "0";
 if ($pCount==null || $pCount=="") $pCount = "10";
 
-$pId = str_replace("%<%", "&lt;", $pId);
-$pId = str_replace("%>%", "&gt;", $pId);
+$pId = htmlspecialchars($pId);
 
 $max = (int)$pCount;
 for ($i=1; $i<=$max; $i++) {
 	$nId = $pId."_".$i;
 	$nName = "tree".$nId;
@@ -22,6 +21,6 @@ for ($i=1; $i<=$max; $i++) {
 	if ($i<$max) {
 		echo ",";
 	}
 	
 }
-?>]
\ No newline at end of file
+?>]

Vulnerable code: $pId = str_replace("%<%", "&lt;", $pId);
$pId = str_replace("%>%", "&gt;", $pId);
$pName = str_replace("%<%", "&lt;", $pName);
$pName = str_replace("%>%", "&gt;", $pName);
$pId = str_replace("%<%", "&lt;", $pId);
$pId = str_replace("%>%", "&gt;", $pId);
?>]
$pId = str_replace("%<%", "&lt;", $pId);
$pId = str_replace("%>%", "&gt;", $pId);
$pName = str_replace("%<%", "&lt;", $pName);
$pName = str_replace("%>%", "&gt;", $pName);
$pId = str_replace("%<%", "&lt;", $pId);
$pId = str_replace("%>%", "&gt;", $pId);
?>]
Fixed code: $pId = htmlspecialchars($pId);
$pName = htmlspecialchars($pName);
$pId = htmlspecialchars($pId);
?>]
$pId = htmlspecialchars($pId);
$pName = htmlspecialchars($pName);
$pId = htmlspecialchars($pId);
?>]