CVE-2023-2428: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-04-30T01:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/admin/record.edit.php
Commit date: 2023-04-06 16:03:00 +0200
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/admin/record.edit.php b/phpmyfaq/admin/record.edit.php
index 1c84b9aba2..d2468b8618 100644
--- a/phpmyfaq/admin/record.edit.php
+++ b/phpmyfaq/admin/record.edit.php
@@ -211,19 +211,19 @@ if (
         $allGroups = false;
         $restrictedGroups = true;
     }
 
     // Set data for forms
-    $faqData['title'] = (isset($faqData['title']) ? Strings::htmlspecialchars($faqData['title']) : '');
+    $faqData['title'] = (isset($faqData['title']) ? Strings::htmlentities($faqData['title']) : '');
     $faqData['content'] =
         (isset($faqData['content']) ? trim(Strings::htmlentities($faqData['content'], ENT_COMPAT, 'utf-8', true)) : '');
-    $faqData['tags'] = (isset($faqData['tags']) ? Strings::htmlspecialchars($faqData['tags']) : '');
-    $faqData['keywords'] = (isset($faqData['keywords']) ? Strings::htmlspecialchars($faqData['keywords']) : '');
-    $faqData['author'] = (isset($faqData['author']) ? Strings::htmlspecialchars(
+    $faqData['tags'] = (isset($faqData['tags']) ? Strings::htmlentities($faqData['tags']) : '');
+    $faqData['keywords'] = (isset($faqData['keywords']) ? Strings::htmlentities($faqData['keywords']) : '');
+    $faqData['author'] = (isset($faqData['author']) ? Strings::htmlentities(
         $faqData['author']
     ) : $user->getUserData('display_name'));
-    $faqData['email'] = (isset($faqData['email']) ? Strings::htmlspecialchars($faqData['email']) : $user->getUserData(
+    $faqData['email'] = (isset($faqData['email']) ? Strings::htmlentities($faqData['email']) : $user->getUserData(
         'email'
     ));
     $faqData['isoDate'] = ($faqData['date'] ?? date('Y-m-d H:i'));
     $faqData['date'] = (isset($faqData['date']) ? $date->format($faqData['date']) : $date->format(date('Y-m-d H:i')));
     $faqData['changed'] = ($faqData['changed'] ?? '');
@@ -360,12 +360,14 @@ if (
                               <form id="faqEditor" action="?action=<?= $queryString ?>" method="post">
                                 <input type="hidden" name="revision_id" id="revision_id" value="<?= $faqData['revision_id'] ?>">
                                 <input type="hidden" name="record_id" id="record_id" value="<?= $faqData['id'] ?>">
                                 <input type="hidden" name="csrf" id="csrf" value="<?= $user->getCsrfTokenFromSession() ?>">
                                 <input type="hidden" name="openQuestionId" id="openQuestionId" value="<?= $questionId ?>">
-                                <input type="hidden" name="notifyUser" id="notifyUser" value="<?= $notifyUser ?>">
-                                <input type="hidden" name="notifyEmail" id="notifyEmail" value="<?= $notifyEmail ?>">
+                                <input type="hidden" name="notifyUser" id="notifyUser"
+                                       value="<?= Strings::htmlentities($notifyUser) ?>">
+                                <input type="hidden" name="notifyEmail" id="notifyEmail"
+                                       value="<?= Strings::htmlentities($notifyEmail) ?>">
 
                                 <!-- Question -->
                                 <div class="form-group">
                                     <input type="text" name="question" id="question"
                                            class="form-control form-control-lg"

Vulnerable code:     $faqData['title'] = (isset($faqData['title']) ? Strings::htmlspecialchars($faqData['title']) : '');
    $faqData['tags'] = (isset($faqData['tags']) ? Strings::htmlspecialchars($faqData['tags']) : '');
    $faqData['keywords'] = (isset($faqData['keywords']) ? Strings::htmlspecialchars($faqData['keywords']) : '');
    $faqData['author'] = (isset($faqData['author']) ? Strings::htmlspecialchars(
    $faqData['email'] = (isset($faqData['email']) ? Strings::htmlspecialchars($faqData['email']) : $user->getUserData(
                                <input type="hidden" name="notifyUser" id="notifyUser" value="<?= $notifyUser ?>">
                                <input type="hidden" name="notifyEmail" id="notifyEmail" value="<?= $notifyEmail ?>">
Fixed code:     $faqData['title'] = (isset($faqData['title']) ? Strings::htmlentities($faqData['title']) : '');
    $faqData['tags'] = (isset($faqData['tags']) ? Strings::htmlentities($faqData['tags']) : '');
    $faqData['keywords'] = (isset($faqData['keywords']) ? Strings::htmlentities($faqData['keywords']) : '');
    $faqData['author'] = (isset($faqData['author']) ? Strings::htmlentities(
    $faqData['email'] = (isset($faqData['email']) ? Strings::htmlentities($faqData['email']) : $user->getUserData(
                                <input type="hidden" name="notifyUser" id="notifyUser"
                                       value="<?= Strings::htmlentities($notifyUser) ?>">
                                <input type="hidden" name="notifyEmail" id="notifyEmail"
                                       value="<?= Strings::htmlentities($notifyEmail) ?>">