CVE-2020-28457: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2020-12-15T16:15Z
Repository: https://github.com/s-cart/s-cart
Language: PHP
Files changed: app/Plugins/Cms/Content/Admin/CmsCategoryController.php, app/Plugins/Cms/Content/Admin/CmsContentController.php
Commit date: 2020-11-29 22:16:58 +0700
Commit message: Hot fix error xss

Diff: diff --git a/app/Plugins/Cms/Content/Admin/CmsCategoryController.php b/app/Plugins/Cms/Content/Admin/CmsCategoryController.php
index 9dd43a7a..6e84e7ea 100644
--- a/app/Plugins/Cms/Content/Admin/CmsCategoryController.php
+++ b/app/Plugins/Cms/Content/Admin/CmsCategoryController.php
@@ -48,12 +48,12 @@ public function index()
             'parent' => trans($this->plugin->pathPlugin.'::Category.parent'),
             'status' => trans($this->plugin->pathPlugin.'::Category.status'),
             'sort' => trans($this->plugin->pathPlugin.'::Category.sort'),
             'action' => trans($this->plugin->pathPlugin.'::Category.admin.action'),
         ];
-        $sort_order = request('sort_order') ?? 'id_desc';
-        $keyword = request('keyword') ?? '';
+        $sort_order = sc_clean(request('sort_order') ?? 'id_desc');
+        $keyword    = sc_clean(request('keyword') ?? '');
         $arrSort = [
             'id__desc' => trans($this->plugin->pathPlugin.'::Category.admin.sort_order.id_desc'),
             'id__asc' => trans($this->plugin->pathPlugin.'::Category.admin.sort_order.id_asc'),
             'title__desc' => trans($this->plugin->pathPlugin.'::Category.admin.sort_order.title_desc'),
             'title__asc' => trans($this->plugin->pathPlugin.'::Category.admin.sort_order.title_asc'),
diff --git a/app/Plugins/Cms/Content/Admin/CmsContentController.php b/app/Plugins/Cms/Content/Admin/CmsContentController.php
index 700b05b7..e535cb3e 100644
--- a/app/Plugins/Cms/Content/Admin/CmsContentController.php
+++ b/app/Plugins/Cms/Content/Admin/CmsContentController.php
@@ -46,12 +46,12 @@ public function index()
             'category_id' => trans($this->plugin->pathPlugin.'::Content.category_id'),
             'status'      => trans($this->plugin->pathPlugin.'::Content.status'),
             'sort'        => trans($this->plugin->pathPlugin.'::Content.sort'),
             'action'      => trans($this->plugin->pathPlugin.'::Content.admin.action'),
         ];
-        $sort_order = request('sort_order') ?? 'id_desc';
-        $keyword = request('keyword') ?? '';
+        $sort_order = sc_clean(request('sort_order') ?? 'id_desc');
+        $keyword    = sc_clean(request('keyword') ?? '');
         $arrSort = [
             'id__desc'    => trans($this->plugin->pathPlugin.'::Content.admin.sort_order.id_desc'),
             'id__asc'     => trans($this->plugin->pathPlugin.'::Content.admin.sort_order.id_asc'),
             'title__desc' => trans($this->plugin->pathPlugin.'::Content.admin.sort_order.title_desc'),
             'title__asc'  => trans($this->plugin->pathPlugin.'::Content.admin.sort_order.title_asc'),

Vulnerable code:         $sort_order = request('sort_order') ?? 'id_desc';
        $keyword = request('keyword') ?? '';
        $sort_order = request('sort_order') ?? 'id_desc';
        $keyword = request('keyword') ?? '';
Fixed code:         $sort_order = sc_clean(request('sort_order') ?? 'id_desc');
        $keyword    = sc_clean(request('keyword') ?? '');
        $sort_order = sc_clean(request('sort_order') ?? 'id_desc');
        $keyword    = sc_clean(request('keyword') ?? '');