CVE-2020-28456: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting (XSS) via the admin panel.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-12-15T16:15Z
Repository: https://github.com/s-cart/core
Language: PHP
Files changed: src/Front/Controllers/ShopCartController.php, src/Front/Controllers/ShopContentController.php, src/Front/Models/ShopOrder.php
Commit date: 2020-12-01 22:37:23 +0700
Commit message: Escape data for front-end

Diff: diff --git a/src/Front/Controllers/ShopCartController.php b/src/Front/Controllers/ShopCartController.php
index 660d4e2..54ef61d 100644
--- a/src/Front/Controllers/ShopCartController.php
+++ b/src/Front/Controllers/ShopCartController.php
@@ -414,10 +414,14 @@ class ShopCartController extends RootFrontController
      * @return [redirect]
      */
     public function addToCart()
     {
         $data      = request()->all();
+        
+        //Process escape
+        $data      = sc_clean($data);
+
         $productId = $data['product_id'];
         $qty       = $data['qty'] ?? 0;
         $storeId   = $data['storeId'] ?? config('app.storeId');
 
         //Process attribute price
@@ -572,11 +576,10 @@ class ShopCartController extends RootFrontController
         }
 
         //Set session info order
         session(['dataOrder' => $dataOrder]);
         session(['arrCartDetail' => $arrCartDetail]);
-
         //Create new order
         $newOrder = (new ShopOrder)->createOrder($dataOrder, $dataTotal, $arrCartDetail);
 
         if ($newOrder['error'] == 1) {
             return redirect(sc_route('cart'))->with(['error' => $newOrder['msg']]);
@@ -595,10 +598,14 @@ class ShopCartController extends RootFrontController
                 'address1'        => $shippingAddress['address1'] ?? '',
                 'address2'        => $shippingAddress['address2'] ?? '',
                 'country'         => $shippingAddress['country'] ?? '',
                 'phone'           => $shippingAddress['phone'] ?? '',
             ];
+
+            //Process escape
+            $addressNew = sc_clean($addressNew);
+
             ShopCustomer::find($uID)->addresses()->save(new ShopCustomerAddress(sc_clean($addressNew)));
             session()->forget('address_process'); //destroy address_process
         }
 
         $paymentMethod = sc_get_class_plugin_controller('Payment', session('paymentMethod'));
diff --git a/src/Front/Controllers/ShopContentController.php b/src/Front/Controllers/ShopContentController.php
index 2bd6eb2..9153b56 100644
--- a/src/Front/Controllers/ShopContentController.php
+++ b/src/Front/Controllers/ShopContentController.php
@@ -198,10 +198,13 @@ class ShopContentController extends RootFrontController
         if ($validator->fails()) {
             return redirect()->back()
                         ->withErrors($validator)
                         ->withInput();
         }
+        // Process escape
+        $data = sc_clean($data);
+        
         //Send email
         $data['content'] = str_replace("\n", "<br>", $data['content']);
 
         if (sc_config('contact_to_admin')) {
             $checkContent = (new ShopEmailTemplate)
diff --git a/src/Front/Models/ShopOrder.php b/src/Front/Models/ShopOrder.php
index b7bcf31..d882281 100644
--- a/src/Front/Models/ShopOrder.php
+++ b/src/Front/Models/ShopOrder.php
@@ -104,13 +104,17 @@ class ShopOrder extends Model
      * @param  [array] $arrCartDetail
      * @return [array]
      */
     public function createOrder($dataOrder, $dataTotal, $arrCartDetail)
     {
+        //Process escape
+        $dataOrder     = sc_clean($dataOrder);
+        $dataTotal     = sc_clean($dataTotal);
+        $arrCartDetail = sc_clean($arrCartDetail);
+
         try {
             DB::connection(SC_CONNECTION)->beginTransaction();
-            $dataOrder = sc_clean($dataOrder);
             $dataOrder['domain'] = url('/');
             $uID = $dataOrder['customer_id'];
             $currency = $dataOrder['currency'];
             $exchange_rate = $dataOrder['exchange_rate'];
 

Vulnerable code: 
            $dataOrder = sc_clean($dataOrder);
Fixed code:         
        //Process escape
        $data      = sc_clean($data);


            //Process escape
            $addressNew = sc_clean($addressNew);

        // Process escape
        $data = sc_clean($data);
        
        //Process escape
        $dataOrder     = sc_clean($dataOrder);
        $dataTotal     = sc_clean($dataTotal);
        $arrCartDetail = sc_clean($arrCartDetail);