CVE-2022-3765: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-10-31T11:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/ajax.config.php, phpmyfaq/admin/meta.edit.php, phpmyfaq/admin/meta.php
Commit date: 2022-10-21 12:59:11 +0200
Commit message: fix: add missing check on special characters for page ID

Diff: diff --git a/phpmyfaq/admin/ajax.config.php b/phpmyfaq/admin/ajax.config.php
index 84131b79d7..7c72fba29a 100644
--- a/phpmyfaq/admin/ajax.config.php
+++ b/phpmyfaq/admin/ajax.config.php
@@ -201,12 +201,12 @@ switch ($ajaxAction) {
 
         $meta = new Meta($faqConfig);
         $entity = new MetaEntity();
 
         $entity
-            ->setPageId(Filter::filterInput(INPUT_GET, 'page_id', FILTER_UNSAFE_RAW))
-            ->setType(Filter::filterInput(INPUT_GET, 'type', FILTER_UNSAFE_RAW))
+            ->setPageId(Filter::filterInput(INPUT_GET, 'page_id', FILTER_SANITIZE_SPECIAL_CHARS))
+            ->setType(Filter::filterInput(INPUT_GET, 'type', FILTER_SANITIZE_SPECIAL_CHARS))
             ->setContent(Filter::filterInput(INPUT_GET, 'content', FILTER_SANITIZE_SPECIAL_CHARS));
 
         $metaId = $meta->add($entity);
 
         if (0 !== $metaId) {
diff --git a/phpmyfaq/admin/meta.edit.php b/phpmyfaq/admin/meta.edit.php
index 5aa9bcc3a7..a9ea66bea0 100644
--- a/phpmyfaq/admin/meta.edit.php
+++ b/phpmyfaq/admin/meta.edit.php
@@ -54,11 +54,11 @@ $metaData = $meta->getById((int)$metaId);
   <input type="hidden" name="meta_id" value="<?= $metaData->getId() ?>">
 
   <div class="form-group row">
     <label for="page_id" class="col-sm-2 col-form-label"><?= $PMF_LANG['ad_meta_page_id'] ?></label>
     <div class="col-sm-10">
-      <input type="text" class="form-control" name="page_id" value="<?= $metaData->getPageId() ?>" required>
+      <input type="text" class="form-control" name="page_id" maxlength="48" value="<?= $metaData->getPageId() ?>" required>
     </div>
   </div>
 
   <div class="form-group row">
     <label for="type" class="col-sm-2 col-form-label"><?= $PMF_LANG['ad_meta_type'] ?></label>
diff --git a/phpmyfaq/admin/meta.php b/phpmyfaq/admin/meta.php
index 8607c22195..ed5e7b466d 100644
--- a/phpmyfaq/admin/meta.php
+++ b/phpmyfaq/admin/meta.php
@@ -133,11 +133,11 @@ $metaData = $meta->getAll();
           <input type="hidden" name="csrf" id="csrf" value="<?= $user->getCsrfTokenFromSession() ?>">
 
           <div class="form-group row">
             <label for="page_id" class="col-sm-2 col-form-label"><?= $PMF_LANG['ad_meta_page_id'] ?></label>
             <div class="col-sm-10">
-              <input type="text" class="form-control" id="page_id" required>
+              <input type="text" class="form-control" id="page_id" maxlength="48" required>
             </div>
           </div>
 
           <div class="form-group row">
             <label for="type" class="col-sm-2 col-form-label"><?= $PMF_LANG['ad_meta_type'] ?></label>

Vulnerable code:             ->setPageId(Filter::filterInput(INPUT_GET, 'page_id', FILTER_UNSAFE_RAW))
            ->setType(Filter::filterInput(INPUT_GET, 'type', FILTER_UNSAFE_RAW))
      <input type="text" class="form-control" name="page_id" value="<?= $metaData->getPageId() ?>" required>
              <input type="text" class="form-control" id="page_id" required>
Fixed code:             ->setPageId(Filter::filterInput(INPUT_GET, 'page_id', FILTER_SANITIZE_SPECIAL_CHARS))
            ->setType(Filter::filterInput(INPUT_GET, 'type', FILTER_SANITIZE_SPECIAL_CHARS))
      <input type="text" class="form-control" name="page_id" maxlength="48" value="<?= $metaData->getPageId() ?>" required>
              <input type="text" class="form-control" id="page_id" maxlength="48" required>