CVE-2017-6908: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in concrete5 <= 5.6.3.4. The vulnerability exists due to insufficient filtration of user-supplied data (fID) passed to the "concrete5-legacy-master/web/concrete/tools/files/selector_data.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-15T00:59Z
Repository: https://github.com/concrete5/concrete5-legacy
Language: PHP
Files changed: web/concrete/tools/files/selector_data.php
Commit date: 2017-03-13 14:09:17 -0400
Commit message: Fix #1948
Diff: diff --git a/web/concrete/tools/files/selector_data.php b/web/concrete/tools/files/selector_data.php
index f823f45ba..9bbaa7ee5 100644
--- a/web/concrete/tools/files/selector_data.php
+++ b/web/concrete/tools/files/selector_data.php
@@ -4,21 +4,22 @@ defined('C5_EXECUTE') or die("Access Denied.");
 if (!Loader::helper('validation/numbers')->integer($_REQUEST['fID'])) {
 	die(t('Access Denied'));
 }
 
 $selectedField = Loader::helper('text')->entities($_REQUEST['ccm_file_selected_field']);
+$fID = Loader::helper('text')->entities($_REQUEST['fID']);
 
 $u = new User();
 $form = Loader::helper('form');
 $fp = FilePermissions::getGlobal();
 if (!$fp->canAccessFileManager()) {
 	die(t("Unable to access the file manager."));
 }
 
 
 
-$f = File::getByID($_REQUEST['fID']);
+$f = File::getByID($fID);
 $fp = new Permissions($f);
 if (!$fp->canViewFileInFileManager()) {
 	die(t("Access Denied."));
 }
 
@@ -26,10 +27,10 @@ $fv = $f->getApprovedVersion();
 
 $canViewInline = $fv->canView() ? 1 : 0;
 $canEdit = $fv->canEdit() ? 1 : 0;
 ?>
 
-<div class="ccm-file-selected" fID="<?=$_REQUEST['fID']?>" ccm-file-manager-field="<?=$selectedField?>" ccm-file-manager-can-duplicate="<?=$fp->canCopyFile()?>" ccm-file-manager-can-admin="<?=($fp->canEditFilePermissions())?>" ccm-file-manager-can-delete="<?=$fp->canDeleteFile()?>" ccm-file-manager-can-view="<?=$canViewInline?>" ccm-file-manager-can-replace="<?=$fp->canEditFileContents()?>" ccm-file-manager-can-edit="<?=$canEdit?>"  >
+<div class="ccm-file-selected" fID="<?=$fID?>" ccm-file-manager-field="<?=$selectedField?>" ccm-file-manager-can-duplicate="<?=$fp->canCopyFile()?>" ccm-file-manager-can-admin="<?=($fp->canEditFilePermissions())?>" ccm-file-manager-can-delete="<?=$fp->canDeleteFile()?>" ccm-file-manager-can-view="<?=$canViewInline?>" ccm-file-manager-can-replace="<?=$fp->canEditFileContents()?>" ccm-file-manager-can-edit="<?=$canEdit?>"  >
 <div class="ccm-file-selected-thumbnail"><?=$fv->getThumbnail(1)?></div>
 <div class="ccm-file-selected-data"><div><?=$fv->getTitle()?></div><div></div></div>
 <div class="ccm-spacer">&nbsp;</div>
-</div>
\ No newline at end of file
+</div>

Vulnerable code: $f = File::getByID($_REQUEST['fID']);
<div class="ccm-file-selected" fID="<?=$_REQUEST['fID']?>" ccm-file-manager-field="<?=$selectedField?>" ccm-file-manager-can-duplicate="<?=$fp->canCopyFile()?>" ccm-file-manager-can-admin="<?=($fp->canEditFilePermissions())?>" ccm-file-manager-can-delete="<?=$fp->canDeleteFile()?>" ccm-file-manager-can-view="<?=$canViewInline?>" ccm-file-manager-can-replace="<?=$fp->canEditFileContents()?>" ccm-file-manager-can-edit="<?=$canEdit?>"  >
</div>
Fixed code: $fID = Loader::helper('text')->entities($_REQUEST['fID']);
$f = File::getByID($fID);
<div class="ccm-file-selected" fID="<?=$fID?>" ccm-file-manager-field="<?=$selectedField?>" ccm-file-manager-can-duplicate="<?=$fp->canCopyFile()?>" ccm-file-manager-can-admin="<?=($fp->canEditFilePermissions())?>" ccm-file-manager-can-delete="<?=$fp->canDeleteFile()?>" ccm-file-manager-can-view="<?=$canViewInline?>" ccm-file-manager-can-replace="<?=$fp->canEditFileContents()?>" ccm-file-manager-can-edit="<?=$canEdit?>"  >
</div>