CVE-2016-10215: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in Fastspot BigTree bigtree-form-builder before 1.2. The vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP POST parameters passed to a "site/index.php/../../extensions/com.fastspot.form-builder/ajax/redraw-field.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-02-10T07:59Z
Repository: https://github.com/Fastspot/bigtree-form-builder
Language: PHP
Files changed: README.md, ajax/redraw-field.php, classes/btx-form-builder.php, manifest.json, templates/routed/btx-form-builder/default.php
Commit date: 2016-12-05 15:17:52 -0500
Commit message: 1.2 release, forgot to add release notes in 1.1

Diff: diff --git a/README.md b/README.md
index 097acef..14e1c66 100644
--- a/README.md
+++ b/README.md
@@ -22,10 +22,19 @@ Form Elements
 - Phone
 
 Changelog
 ---------
 
+### 1.2 Release
+- Fixed potential XSS attack via redraw-field (thanks to Haojun Hou in ADLab of Venustech)
+- Fixed drawing back to back column sets breaking the display
+
+### 1.1 Release
+- Auto responder email support
+- Fixed limiting entries not showing properly after being checked while editing
+- Fixed invalid dates coming through date fields (thanks to Jordan Mason)
+
 ### 1.0.1 Release
 - Added a check to make sure users don't have duplicate values in select / radio / checkboxes when saving
 
 ### 1.0 Release
 - First public release for BigTree 4.2
diff --git a/ajax/redraw-field.php b/ajax/redraw-field.php
index 56bb0d9..c78da10 100755
--- a/ajax/redraw-field.php
+++ b/ajax/redraw-field.php
@@ -1,10 +1,12 @@
 <?php
 	$required = false;
 	$label = "";
-	$type = trim($_POST["type"]);
-	$key = str_replace("form_builder_element_", "", $_POST["name"]);
+	$key = htmlspecialchars(str_replace("form_builder_element_", "", $_POST["name"]));
+
+	// We URLify to prevent any kind of weird include jacking via ../
+	$type = BigTreeCMS::urlify(trim($_POST["type"]));
 	
 	// Clean up prices
 	if ($_POST["list"]["list"]) {
 		foreach ($_POST["list"]["list"] as &$item) {
 			if ($item["price"]) {
@@ -17,12 +19,12 @@
 		unset($item);
 	}
 	
 	$data = $_POST;
 ?>
-<input type="hidden" name="id[<?=$key?>]" value="<?=$_POST["id"]?>" />
-<input type="hidden" name="type[<?=$key?>]" value="<?=$type?>" />
+<input type="hidden" name="id[<?=$key?>]" value="<?=htmlspecialchars($_POST["id"])?>" />
+<input type="hidden" name="type[<?=$key?>]" value="<?=htmlspecialchars($type)?>" />
 <input type="hidden" name="data[<?=$key?>]" value="<?=htmlspecialchars(json_encode($data))?>" />
 <div class="form_builder_wrapper">
 	<span class="icon"></span>
 	<?php include EXTENSION_ROOT."modules/btx-form-builder/field-types/redraw/$type.php" ?>
 </div>
diff --git a/classes/btx-form-builder.php b/classes/btx-form-builder.php
index 58dd76e..cb57188 100755
--- a/classes/btx-form-builder.php
+++ b/classes/btx-form-builder.php
@@ -3,12 +3,13 @@
 		Class: BTXFormBuilder
 			Provides an interface for form builder data.
 	*/
 
 	class BTXFormBuilder extends BigTreeModule {
-		var $Table = "btx_form_builder_forms";
-		static $SearchPageCount = false;
+		public $Table = "btx_form_builder_forms";
+
+		public static $SearchPageCount = false;
 		
 		/*
 			Function: getForm
 				Gets form information and related fields.
 
@@ -27,31 +28,36 @@
 			}
 
 			$fields = array();
 			$object_count = 0;
 			$field_query = sqlquery("SELECT * FROM btx_form_builder_fields WHERE form = '$id' AND `column` = '0' ORDER BY position DESC, id ASC");
+			
 			while ($field = sqlfetch($field_query)) {
 				$object_count++;
 
 				if ($field["type"] == "column") {
 					// Get left column
 					$column_fields = array();
 					$column_query = sqlquery("SELECT * FROM btx_form_builder_fields WHERE `column` = '".$field["id"]."' AND `alignment` = 'left' ORDER BY position DESC, id ASC");
+					
 					while ($sub_field = sqlfetch($column_query)) {
 						$column_fields[] = $sub_field;
 						$object_count++;
 					}
+
 					$field["fields"] = $column_fields;
 					$fields[] = $field;
 
 					// Get right column
 					$column_fields = array();
 					$column_query = sqlquery("SELECT * FROM btx_form_builder_fields WHERE `column` = '".$field["id"]."' AND `alignment` = 'right' ORDER BY position DESC, id ASC");
+					
 					while ($sub_field = sqlfetch($column_query)) {
 						$column_fields[] = $sub_field;
 						$object_count++;
 					}
+					
 					$field["fields"] = $column_fields;
 					$fields[] = $field;
 
 					// Column start/end count as objects so we add 3 since there's two columns
 					$object_count += 3;
@@ -60,10 +66,11 @@
 				}
 			}
 
 			$form["fields"] = $fields;
 			$form["object_count"] = $object_count - 1; // We start at 0
+
 			return $form;
 		}
 
 		/*
 			Function: getAllForms
@@ -76,10 +83,11 @@
 				An array of form arrays.
 		*/
 		
 		static function getAllForms($sort = "id ASC") {
 			$mod = new BigTreeModule("btx_form_builder_forms");
+
 			return $mod->getAll($sort);
 		}
 
 		/*
 			Function: getEntries
@@ -92,10 +100,11 @@
 				An array of entries arrays.
 		*/
 		
 		static function getEntries($id) {
 			$mod = new BigTreeModule("btx_form_builder_entries");
+
 			return $mod->getMatching("form",$id,"id DESC");
 		}
 
 		/*
 			Function: getEntry
@@ -182,6 +191,6 @@
 			$pages = ceil(count($form_results) / 15);
 			self::$SearchPageCount = $pages ? $pages : 1;
 
 			return array_slice($form_results,($page - 1) * 15,15);
 		}
-	}
\ No newline at end of file
+	}
diff --git a/manifest.json b/manifest.json
index 9d01a98..8ca5843 100755
--- a/manifest.json
+++ b/manifest.json
@@ -1,10 +1,10 @@
 {
     "type": "extension",
     "id": "com.fastspot.form-builder",
-    "version": "1.1",
-    "revision": 21,
+    "version": "1.2",
+    "revision": 22,
     "compatibility": "4.2+",
     "title": "Form Builder",
     "description": "An easy to use form builder allowing the administrative users to easily add fields to a form that stores entries in the database and sends out emails. Also supports paid forms.",
     "keywords": [
         "forms",
@@ -72,11 +72,11 @@
                         "in_nav": "on",
                         "form": null,
                         "view": null,
                         "report": null,
                         "class": "server",
-                        "level": "0",
+                        "level": "2",
                         "position": "1"
                     }
                 ],
                 "views": [
                     {
diff --git a/templates/routed/btx-form-builder/default.php b/templates/routed/btx-form-builder/default.php
index b3df0d3..57f6b53 100755
--- a/templates/routed/btx-form-builder/default.php
+++ b/templates/routed/btx-form-builder/default.php
@@ -87,10 +87,13 @@
 				
 				include "field-types/draw/$field_type.php";
 			} else {
 				if ($last_field == "column") {
 					echo '<div class="form_builder_column form_builder_last">';
+
+					// Reset so that if someone did back to back columns it draws properly
+					$field_type = "second_column";
 				} else {
 					echo '<div class="form_builder_column">';
 				}
 				
 				foreach ($field["fields"] as $subfield) {
@@ -122,10 +125,11 @@
 					include "field-types/draw/".$subfield["type"].".php";
 				}
 				
 				echo '</div>';
 			}
+
 			$last_field = $field_type;
 		}
 	?>
 	<input type="submit" class="form_builder_submit" value="Submit" />
 </form>

Vulnerable code: 	$type = trim($_POST["type"]);
	$key = str_replace("form_builder_element_", "", $_POST["name"]);
<input type="hidden" name="id[<?=$key?>]" value="<?=$_POST["id"]?>" />
<input type="hidden" name="type[<?=$key?>]" value="<?=$type?>" />
		var $Table = "btx_form_builder_forms";
		static $SearchPageCount = false;
	}
    "version": "1.1",
    "revision": 21,
                        "level": "0",
Fixed code: ### 1.2 Release
- Fixed potential XSS attack via redraw-field (thanks to Haojun Hou in ADLab of Venustech)
- Fixed drawing back to back column sets breaking the display

### 1.1 Release
- Auto responder email support
- Fixed limiting entries not showing properly after being checked while editing
- Fixed invalid dates coming through date fields (thanks to Jordan Mason)

	$key = htmlspecialchars(str_replace("form_builder_element_", "", $_POST["name"]));

	// We URLify to prevent any kind of weird include jacking via ../
	$type = BigTreeCMS::urlify(trim($_POST["type"]));
<input type="hidden" name="id[<?=$key?>]" value="<?=htmlspecialchars($_POST["id"])?>" />
<input type="hidden" name="type[<?=$key?>]" value="<?=htmlspecialchars($type)?>" />
		public $Table = "btx_form_builder_forms";

		public static $SearchPageCount = false;
			
					

					
					



	}
    "version": "1.2",
    "revision": 22,
                        "level": "2",

					// Reset so that if someone did back to back columns it draws properly
					$field_type = "second_column";