CVE-2015-2796: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script or HTML via the search_for parameter to (1) search_by_tag.php, (2) search_contacts.php, or (3) search.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-02-02T21:29Z
Repository: https://github.com/Project-Pier/ProjectPier-Core
Language: PHP
Files changed: application/views/dashboard/search_by_tag.php, application/views/dashboard/search_contacts.php, application/views/project/search.php
Commit date: 2015-04-02 19:50:18 -0400
Commit message: Commit to fix Security Issue - XSS - CVE-2015-2796 reference issue #37

Diff: diff --git a/application/views/dashboard/search_by_tag.php b/application/views/dashboard/search_by_tag.php
index 3c74218..718e824 100644
--- a/application/views/dashboard/search_by_tag.php
+++ b/application/views/dashboard/search_by_tag.php
@@ -63,7 +63,7 @@ foreach ($contacts as $contact) {
     <div class="clear"></div>
   </div>
 <?php } // foreach ?>
 </div>
 <?php } else { ?>
-  <div><?php echo lang('no search result for', $search_term) ?></div>
+  <div><?php echo lang('no search result for', clean($search_term)) ?></div>
 <?php } // if ?>
\ No newline at end of file
diff --git a/application/views/dashboard/search_contacts.php b/application/views/dashboard/search_contacts.php
index 42f0309..4273e5e 100644
--- a/application/views/dashboard/search_contacts.php
+++ b/application/views/dashboard/search_contacts.php
@@ -68,7 +68,7 @@ if (is_array($contacts)) {
 <?php } // foreach ?>
 <?php } // if ?>
   <div id="contactsPaginationBottom"><?php echo advanced_pagination($contacts_pagination, get_url('dashboard', 'search_contacts', array('search_for' => $search_term, 'page' => '#PAGE#'))) ?></div>
 </div>
 <?php } else { ?>
-  <div><?php echo lang('no search result for', $search_term) ?></div>
+  <div><?php echo lang('no search result for', clean($search_term)) ?></div>
 <?php } // if ?>
\ No newline at end of file
diff --git a/application/views/project/search.php b/application/views/project/search.php
index 3af2c82..9dd367c 100644
--- a/application/views/project/search.php
+++ b/application/views/project/search.php
@@ -29,7 +29,7 @@
 <?php if (isset($pagination) && ($pagination instanceof DataPagination)) { ?>
 <?php echo advanced_pagination($pagination, active_project()->getSearchUrl($search_string, '#PAGE#')); ?>
 <?php } // if ?>
 
 <?php } else { ?>
-<p><?php echo lang('no search result for', $search_string) ?></p>
+<p><?php echo lang('no search result for', clean($search_string)) ?></p>
 <?php } // if ?>
\ No newline at end of file

Vulnerable code:   <div><?php echo lang('no search result for', $search_term) ?></div>
  <div><?php echo lang('no search result for', $search_term) ?></div>
<p><?php echo lang('no search result for', $search_string) ?></p>
Fixed code:   <div><?php echo lang('no search result for', clean($search_term)) ?></div>
  <div><?php echo lang('no search result for', clean($search_term)) ?></div>
<p><?php echo lang('no search result for', clean($search_string)) ?></p>