CVE-2022-3766: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-10-31T11:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/index.php, phpmyfaq/search.php, phpmyfaq/src/phpMyFAQ/Strings.php
Commit date: 2022-10-21 14:57:20 +0200
Commit message: fix: added missing quoting for search terms

Diff: diff --git a/phpmyfaq/index.php b/phpmyfaq/index.php
index fd6cf8f999..3b358414de 100755
--- a/phpmyfaq/index.php
+++ b/phpmyfaq/index.php
@@ -547,11 +547,11 @@ $tplMainPage = [
     'currentPageUrl' => $currentPageUrl,
     'action' => $action,
     'dir' => $PMF_LANG['dir'],
     'writeSendAdress' => '?' . $sids . 'action=search',
     'searchBox' => $PMF_LANG['msgSearch'],
-    'searchTerm' => Strings::htmlspecialchars($searchTerm),
+    'searchTerm' => Strings::htmlspecialchars($searchTerm, ENT_QUOTES),
     'categoryId' => ($cat === 0) ? '%' : (int)$cat,
     'headerCategories' => $PMF_LANG['msgFullCategories'],
     'msgCategory' => $PMF_LANG['msgCategory'],
     'showCategories' => $categoryHelper->renderNavigation($cat),
     'topCategories' => $categoryHelper->renderMainCategories(),
diff --git a/phpmyfaq/search.php b/phpmyfaq/search.php
index 84632735dc..81fe436779 100755
--- a/phpmyfaq/search.php
+++ b/phpmyfaq/search.php
@@ -284,11 +284,11 @@ if ($tagSearch) {
     $template->parseBlock(
         'mainPageContent',
         'searchBoxSection',
         [
             'writeSendAdress' => '?' . $sids . 'action=search',
-            'searchString' => Strings::htmlspecialchars($inputSearchTerm, ENT_QUOTES, 'utf-8'),
+            'searchString' => Strings::htmlspecialchars($inputSearchTerm, ENT_QUOTES),
             'searchOnAllLanguages' => $PMF_LANG['msgSearchOnAllLanguages'],
             'checkedAllLanguages' => $allLanguages ? ' checked' : '',
             'selectCategories' => $PMF_LANG['msgSelectCategories'],
             'allCategories' => $PMF_LANG['msgAllCategories'],
             'renderCategoryOptions' => $categoryHelper->renderOptions($inputCategory),
diff --git a/phpmyfaq/src/phpMyFAQ/Strings.php b/phpmyfaq/src/phpMyFAQ/Strings.php
index 53622542c7..dde749e294 100644
--- a/phpmyfaq/src/phpMyFAQ/Strings.php
+++ b/phpmyfaq/src/phpMyFAQ/Strings.php
@@ -303,13 +303,13 @@ class Strings
      * @param bool   $doubleEncode If set to false, no encoding of existing entities
      * @return string
      */
     public static function htmlentities(
         string $string,
-        $quoteStyle = ENT_HTML5,
-        $charset = 'utf-8',
-        $doubleEncode = true
+        int $quoteStyle = ENT_HTML5,
+        string $charset = 'utf-8',
+        bool $doubleEncode = false
     ): string
     {
         return htmlentities(
             $string,
             $quoteStyle,

Vulnerable code:     'searchTerm' => Strings::htmlspecialchars($searchTerm),
            'searchString' => Strings::htmlspecialchars($inputSearchTerm, ENT_QUOTES, 'utf-8'),
        $quoteStyle = ENT_HTML5,
        $charset = 'utf-8',
        $doubleEncode = true
Fixed code:     'searchTerm' => Strings::htmlspecialchars($searchTerm, ENT_QUOTES),
            'searchString' => Strings::htmlspecialchars($inputSearchTerm, ENT_QUOTES),
        int $quoteStyle = ENT_HTML5,
        string $charset = 'utf-8',
        bool $doubleEncode = false