CVE-2014-125105: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Broken Link Checker Plugin up to 1.10.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function options_page of the file core/core.php of the component Settings Page. The manipulation of the argument exclusion_list/blc_custom_fields leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.10.2 is able to address this issue. The patch is named 90615fe9b0b6f9e6fb254d503c302e53a202e561. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230659.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-05T01:15Z
Repository: https://github.com/wp-plugins/broken-link-checker
Language: PHP
Files changed: core/core.php
Commit date: 2014-12-04 14:31:42 +0000
Commit message: Fixed an XSS vulnerability on the link checker settings page. Two input fields were not properly escaped, which would allow a malicious admin-level user to insert arbitrary HTML/JS into the page.

Also fixed certain special characters being prefixed with slashes after saving settings. This was caused by WordPress automatically applying "magic quotes" (as in the deprecated PHP "feature") to all POST fields.

git-svn-id: https://plugins.svn.wordpress.org/broken-link-checker/trunk@1038180 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/core/core.php b/core/core.php
index b93c82b..d0ed1bc 100644
--- a/core/core.php
+++ b/core/core.php
@@ -461,22 +461,22 @@ class wsBrokenLinkChecker {
             
             $this->conf->options['nofollow_broken_links'] = !empty($_POST['nofollow_broken_links']);
 			
             $this->conf->options['suggestions_enabled'] = !empty($_POST['suggestions_enabled']);
 
-            $this->conf->options['exclusion_list'] = array_filter( 
+            $this->conf->options['exclusion_list'] = array_filter(
 				preg_split( 
 					'/[\s\r\n]+/',				//split on newlines and whitespace 
-					$_POST['exclusion_list'], 
+					$cleanPost['exclusion_list'],
 					-1,
 					PREG_SPLIT_NO_EMPTY			//skip empty values
 				) 
 			);
                 
             //Parse the custom field list
             $new_custom_fields = array_filter( 
-				preg_split( '/[\r\n]+/', $_POST['blc_custom_fields'], -1, PREG_SPLIT_NO_EMPTY )
+				preg_split( '/[\r\n]+/', $cleanPost['blc_custom_fields'], -1, PREG_SPLIT_NO_EMPTY )
 			);
             
 			//Calculate the difference between the old custom field list and the new one (used later)
             $diff1 = array_diff( $new_custom_fields, $this->conf->options['custom_fields'] );
             $diff2 = array_diff( $this->conf->options['custom_fields'], $new_custom_fields );
@@ -991,11 +991,11 @@ class wsBrokenLinkChecker {
     	<tr valign="top">
         <th scope="row"><?php _e('Exclusion list', 'broken-link-checker'); ?></th>
         <td><?php _e("Don't check links where the URL contains any of these words (one per line) :", 'broken-link-checker'); ?><br/>
         <textarea name="exclusion_list" id="exclusion_list" cols='45' rows='4'><?php
             if( isset($this->conf->options['exclusion_list']) )
-                echo implode("\n", $this->conf->options['exclusion_list']);
+                echo esc_textarea(implode("\n", $this->conf->options['exclusion_list']));
         ?></textarea>
 
         </td>
         </tr>
         
@@ -1401,11 +1401,11 @@ class wsBrokenLinkChecker {
 						'broken-link-checker'
 					) .
 				 '</span>';
     	$html .= '<br><textarea name="blc_custom_fields" id="blc_custom_fields" cols="45" rows="4">';
         if( isset($current_settings['custom_fields']) )
-            $html .= implode("\n", $current_settings['custom_fields']);
+            $html .= esc_textarea(implode("\n", $current_settings['custom_fields']));
         $html .= '</textarea>';
         
         return $html;
     }
     

Vulnerable code:             $this->conf->options['exclusion_list'] = array_filter( 
					$_POST['exclusion_list'], 
				preg_split( '/[\r\n]+/', $_POST['blc_custom_fields'], -1, PREG_SPLIT_NO_EMPTY )
                echo implode("\n", $this->conf->options['exclusion_list']);
            $html .= implode("\n", $current_settings['custom_fields']);
Fixed code:             $this->conf->options['exclusion_list'] = array_filter(
					$cleanPost['exclusion_list'],
				preg_split( '/[\r\n]+/', $cleanPost['blc_custom_fields'], -1, PREG_SPLIT_NO_EMPTY )
                echo esc_textarea(implode("\n", $this->conf->options['exclusion_list']));
            $html .= esc_textarea(implode("\n", $current_settings['custom_fields']));