CVE-2021-28280: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-04-29T15:15Z
Repository: https://github.com/PHPFusion/PHPFusion
Language: PHP
Files changed: includes/classes/PHPFusion/Search/Search_Engine.php
Commit date: 2021-03-10 18:12:25 +0800
Commit message: Prevent unwanted vars redirection.
Just to mitigate flooding of error logs, redirect if someone do malicious attempts on the search script.

Diff: diff --git a/includes/classes/PHPFusion/Search/Search_Engine.php b/includes/classes/PHPFusion/Search/Search_Engine.php
index 0ad12eac9..c5320abd5 100644
--- a/includes/classes/PHPFusion/Search/Search_Engine.php
+++ b/includes/classes/PHPFusion/Search/Search_Engine.php
@@ -293,25 +293,30 @@ class Search_Engine extends Search_Model {
      * @param null $key
      *
      * @return array|string
      */
     public static function get_param($key = NULL) {
-        $info = [
-            'stype'        => htmlentities(self::$search_type),
-            'stext'        => htmlentities(self::$search_text),
-            'method'       => htmlentities(self::$search_method),
-            'datelimit'    => self::$search_date_limit,
-            'fields'       => self::$search_fields,
-            'sort'         => self::$search_sort,
-            'chars'        => htmlentities(self::$search_chars),
-            'order'        => self::$search_order,
-            'forum_id'     => self::$forum_id,
-            'memory_limit' => self::$memory_limit,
-            'composevars'  => self::$composevars,
-            'rowstart'     => self::$rowstart,
-            'search_param' => self::$search_param,
-        ];
+        try {
+            $info = [
+                'stype'        => stripinput(self::$search_type),
+                'stext'        => stripinput(self::$search_text),
+                'method'       => stripinput(self::$search_method),
+                'datelimit'    => self::$search_date_limit,
+                'fields'       => self::$search_fields,
+                'sort'         => self::$search_sort,
+                'chars'        => stripinput(self::$search_chars),
+                'order'        => self::$search_order,
+                'forum_id'     => self::$forum_id,
+                'memory_limit' => self::$memory_limit,
+                'composevars'  => self::$composevars,
+                'rowstart'     => self::$rowstart,
+                'search_param' => self::$search_param,
+            ];
+        } catch (\Exception $e) {
+            redirect(BASEDIR.fusion_get_settings('opening_page'));
+        }
+
 
         return $key === NULL ? $info : (isset($info[$key]) ? $info[$key] : NULL);
     }
 
     /**

Vulnerable code:         $info = [
            'stype'        => htmlentities(self::$search_type),
            'stext'        => htmlentities(self::$search_text),
            'method'       => htmlentities(self::$search_method),
            'datelimit'    => self::$search_date_limit,
            'fields'       => self::$search_fields,
            'sort'         => self::$search_sort,
            'chars'        => htmlentities(self::$search_chars),
            'order'        => self::$search_order,
            'forum_id'     => self::$forum_id,
            'memory_limit' => self::$memory_limit,
            'composevars'  => self::$composevars,
            'rowstart'     => self::$rowstart,
            'search_param' => self::$search_param,
        ];
Fixed code:         try {
            $info = [
                'stype'        => stripinput(self::$search_type),
                'stext'        => stripinput(self::$search_text),
                'method'       => stripinput(self::$search_method),
                'datelimit'    => self::$search_date_limit,
                'fields'       => self::$search_fields,
                'sort'         => self::$search_sort,
                'chars'        => stripinput(self::$search_chars),
                'order'        => self::$search_order,
                'forum_id'     => self::$forum_id,
                'memory_limit' => self::$memory_limit,
                'composevars'  => self::$composevars,
                'rowstart'     => self::$rowstart,
                'search_param' => self::$search_param,
            ];
        } catch (\Exception $e) {
            redirect(BASEDIR.fusion_get_settings('opening_page'));
        }