CVE-2023-1882: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-04-05T17:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/contact.php, phpmyfaq/index.php, phpmyfaq/request-removal.php
Commit date: 2023-02-12 20:46:35 +0100
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/contact.php b/phpmyfaq/contact.php
index e66f8dd0da..27a9a9c4c4 100644
--- a/phpmyfaq/contact.php
+++ b/phpmyfaq/contact.php
@@ -47,11 +47,11 @@ $template->parse(
     [
         'pageHeader' => $PMF_LANG['msgContact'],
         'msgContactOwnText' => nl2br(Strings::htmlspecialchars($faqConfig->get('main.contactInformations'))),
         'msgContactEMail' => $PMF_LANG['msgContactEMail'],
         'msgContactPrivacyNote' => $PMF_LANG['msgContactPrivacyNote'],
-        'privacyURL' => $faqConfig->get('main.privacyURL'),
+        'privacyURL' => Strings::htmlentities($faqConfig->get('main.privacyURL')),
         'msgPrivacyNote' => $PMF_LANG['msgPrivacyNote'],
         'msgNewContentName' => $PMF_LANG['msgNewContentName'],
         'msgNewContentMail' => $PMF_LANG['msgNewContentMail'],
         'lang' => $Language->getLanguage(),
         'defaultContentMail' => ($user instanceof CurrentUser) ? $user->getUserData('email') : '',
diff --git a/phpmyfaq/index.php b/phpmyfaq/index.php
index a0f2cd1ccc..2f06ce265c 100755
--- a/phpmyfaq/index.php
+++ b/phpmyfaq/index.php
@@ -617,11 +617,11 @@ if ($faqConfig->get('main.enableRewriteRules')) {
             '</a>',
         'msgContact' => '<a href="./contact.html">' . $PMF_LANG['msgContact'] . '</a>',
         'msgGlossary' => '<a href="./glossary.html">' . $PMF_LANG['ad_menu_glossary'] . '</a>',
         'privacyLink' => sprintf(
             '<a target="_blank" href="%s">%s</a>',
-            $faqConfig->get('main.privacyURL'),
+            Strings::htmlentities($faqConfig->get('main.privacyURL')),
             $PMF_LANG['msgPrivacyNote']
         ),
         'backToHome' => '<a href="./index.html">' . $PMF_LANG['msgHome'] . '</a>',
         'allCategories' => '<a class="nav-link" href="./showcat.html">' . $PMF_LANG['msgShowAllCategories'] . '</a>',
         'faqOverview' => '<a href="./overview.html">' . $PMF_LANG['faqOverview'] . '</a>',
@@ -640,11 +640,11 @@ if ($faqConfig->get('main.enableRewriteRules')) {
             $PMF_LANG['msgOpenQuestions'] . '</a>',
         'msgContact' => '<a href="index.php?' . $sids . 'action=contact">' . $PMF_LANG['msgContact'] . '</a>',
         'msgGlossary' => '<a href="index.php?' . $sids . 'action=glossary">' . $PMF_LANG['ad_menu_glossary'] . '</a>',
         'privacyLink' => sprintf(
             '<a target="_blank" href="%s">%s</a>',
-            $faqConfig->get('main.privacyURL'),
+            Strings::htmlentities($faqConfig->get('main.privacyURL')),
             $PMF_LANG['msgPrivacyNote']
         ),
         'allCategories' => '<a class="nav-link" href="index.php?' . $sids . 'action=show">' .
             $PMF_LANG['msgShowAllCategories'] . '</a>',
         'faqOverview' => '<a href="index.php?' . $sids . 'action=overview">' . $PMF_LANG['faqOverview'] . '</a>',
diff --git a/phpmyfaq/request-removal.php b/phpmyfaq/request-removal.php
index 554273ae41..d4dfc15adc 100644
--- a/phpmyfaq/request-removal.php
+++ b/phpmyfaq/request-removal.php
@@ -16,10 +16,11 @@
  */
 
 use phpMyFAQ\Captcha;
 use phpMyFAQ\Core\Exception;
 use phpMyFAQ\Helper\CaptchaHelper;
+use phpMyFAQ\Strings;
 use phpMyFAQ\User\CurrentUser;
 
 if (!defined('IS_VALID_PHPMYFAQ')) {
     http_response_code(400);
     exit();
@@ -48,11 +49,11 @@ $template->parse(
         'msgContact' => $PMF_LANG['msgContact'],
         'msgUserRemovalText' => $PMF_LANG['msgUserRemovalText'],
         'msgContactRemove' => $PMF_LANG['msgContactRemove'],
         'msgContactPrivacyNote' => $PMF_LANG['msgContactPrivacyNote'],
         'msgPrivacyNote' => $PMF_LANG['msgPrivacyNote'],
-        'privacyURL' => $faqConfig->get('main.privacyURL'),
+        'privacyURL' => Strings::htmlentities($faqConfig->get('main.privacyURL')),
         'msgNewContentName' => $PMF_LANG['msgNewContentName'],
         'msgNewContentMail' => $PMF_LANG['msgNewContentMail'],
         'ad_user_loginname' => $PMF_LANG['ad_user_loginname'],
         'lang' => $Language->getLanguage(),
         'defaultContentMail' => ($user instanceof CurrentUser) ? $user->getUserData('email') : '',

Vulnerable code:         'privacyURL' => $faqConfig->get('main.privacyURL'),
            $faqConfig->get('main.privacyURL'),
            $faqConfig->get('main.privacyURL'),
        'privacyURL' => $faqConfig->get('main.privacyURL'),
Fixed code:         'privacyURL' => Strings::htmlentities($faqConfig->get('main.privacyURL')),
            Strings::htmlentities($faqConfig->get('main.privacyURL')),
            Strings::htmlentities($faqConfig->get('main.privacyURL')),
use phpMyFAQ\Strings;
        'privacyURL' => Strings::htmlentities($faqConfig->get('main.privacyURL')),