CVE-2020-35132: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-12-11T05:15Z
Repository: https://github.com/leenooks/phpLDAPadmin
Language: PHP
Files changed: lib/functions.php
Commit date: 2019-07-31 08:21:14 -0700
Commit message: Fix error and set by default to preventXSS
Diff: diff --git a/lib/functions.php b/lib/functions.php
index 6e223b1..bad1ee9 100644
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -649,11 +649,11 @@ function error($msg,$type='note',$redirect=null,$fatal=false,$backtrace=false) {
 /**
  * Return the result of a form variable, with optional default
  *
  * @return The form GET/REQUEST/SESSION/POST variable value or its default
  */
-function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=false) {
+function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=true) {
 	switch($type) {
 		case 'GET':
 			$value = isset($_GET[$attr]) ? (is_array($_GET[$attr]) ? $_GET[$attr] : (empty($_GET['nodecode'][$attr]) ? rawurldecode($_GET[$attr]) : $_GET[$attr])) : $default;
 			break;
 
@@ -673,25 +673,35 @@ function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=fal
 	
 	if ($die && is_null($value))
 		system_message(array(
 			'title'=>_('Generic Error'),
 			'body'=>sprintf('%s: Called "%s" without "%s" using "%s"',
-				basename($_SERVER['PHP_SELF']),get_request('cmd','REQUEST',false,null,true),preventXSS($attr),preventXSS($type)),
+				basename($_SERVER['PHP_SELF']),get_request('cmd','REQUEST'),preventXSS($attr),preventXSS($type)),
 			'type'=>'error'),
 			'index.php');
 	if($preventXSS && !is_null($value))
 		$value = preventXSS($value);
 	return $value;
 }
 /**
 *  Prevent XSS function. This function can usage has preventXSS(get_request('cmd','REQUEST'))
 *  Return valor escape XSS.
 */
-function preventXSS($value){
-	return htmlspecialchars(addslashes($value), ENT_QUOTES, 'UTF-8');
-}
-
+ function preventXSS($data){
+        if (gettype($data) == 'array') {
+            foreach ($data as $key => $value) {
+                if (gettype($value) == 'array')
+                    $data[$key] = preventXSS($value);
+                else
+                    $data[$key] = htmlspecialchars($value);
+            }
+            return $data;
+        }
+        return htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
+}
+
+/*
  * Record a system message.
  * This function can be used as an alternative to generate a system message, if page hasnt yet been defined.
  */
 function system_message($msg,$redirect=null) {
 	if (! is_array($msg))

Vulnerable code: function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=false) {
				basename($_SERVER['PHP_SELF']),get_request('cmd','REQUEST',false,null,true),preventXSS($attr),preventXSS($type)),
function preventXSS($value){
	return htmlspecialchars(addslashes($value), ENT_QUOTES, 'UTF-8');
}

Fixed code: function get_request($attr,$type='POST',$die=false,$default=null,$preventXSS=true) {
				basename($_SERVER['PHP_SELF']),get_request('cmd','REQUEST'),preventXSS($attr),preventXSS($type)),
 function preventXSS($data){
        if (gettype($data) == 'array') {
            foreach ($data as $key => $value) {
                if (gettype($value) == 'array')
                    $data[$key] = preventXSS($value);
                else
                    $data[$key] = htmlspecialchars($value);
            }
            return $data;
        }
        return htmlspecialchars($data, ENT_QUOTES, 'UTF-8');
}

/*