CVE-2017-6511: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-07T19:59Z
Repository: https://github.com/andrzuk/FineCMS
Language: PHP
Files changed: application/classes/application.php, application/core/view/roles.php, application/core/view/users.php
Commit date: 2017-03-06 08:55:38 +0100
Commit message: Add filtration of URL action parameter.

Diff: diff --git a/application/classes/application.php b/application/classes/application.php
index 4718f16..bbe5b9a 100644
--- a/application/classes/application.php
+++ b/application/classes/application.php
@@ -86,11 +86,11 @@ class Application
 
 		define ('MODULE_NAME', $module->get_name());
 
 		$class_file = APP_DIR . 'controller/' . MODULE_NAME . '.php';
 		$class_name = ucfirst(MODULE_NAME) . '_Controller';
-		$class_method = ucfirst($action) . '_Action';
+		$class_method = ucfirst(strip_tags($action)) . '_Action';
 
 		// tworzy obiekt kontrolera:
 
 		if (file_exists($class_file))
 		{
diff --git a/application/core/view/roles.php b/application/core/view/roles.php
index f1955be..dc9bf27 100644
--- a/application/core/view/roles.php
+++ b/application/core/view/roles.php
@@ -11,15 +11,15 @@ class Roles_View extends View
 	{
 		$title = 'Role użytkowników';
 		$image = 'img/32x32/lock_go.png';
 
 		$attribs = array(
-			array('width' => '5%',  'align' => 'center', 'visible' => '1'),
-			array('width' => '10%', 'align' => 'center', 'visible' => '1', 'image' => '1'),
-			array('width' => '15%', 'align' => 'center', 'visible' => '1'),
-			array('width' => '10%', 'align' => 'center', 'visible' => '1'),
-			array('width' => '50%', 'align' => 'center', 'visible' => '1'),
+			array('width' => '10%',  'align' => 'center', 'visible' => '1'),
+			array('width' => '15%', 'align' => 'left', 'visible' => '1', 'image' => '1'),
+			array('width' => '20%', 'align' => 'left', 'visible' => '1'),
+			array('width' => '10%', 'align' => 'left', 'visible' => '1'),
+			array('width' => '30%', 'align' => 'left', 'visible' => '1'),
 			array('width' => '10%', 'align' => 'center', 'visible' => '1'),
 		);
 		
 		$actions = array(
 			array('action' => 'view',   'icon' => 'info.png',  'title' => 'Podgląd'),
diff --git a/application/core/view/users.php b/application/core/view/users.php
index 87d7035..cedd4e2 100644
--- a/application/core/view/users.php
+++ b/application/core/view/users.php
@@ -12,20 +12,20 @@ class Users_View extends View
 		$title = 'Użytkownicy serwisu';
 		$image = 'img/32x32/users_group.png';
 
 		$attribs = array(
 			array('width' => '5%',  'align' => 'center', 'visible' => '1'),
-			array('width' => '8%', 'align' => 'left',   'visible' => '1', 'image' => '1'),
-			array('width' => '5%',  'align' => 'left',   'visible' => '0'),
-			array('width' => '8%', 'align' => 'left',   'visible' => '1'),
+			array('width' => '10%', 'align' => 'left',   'visible' => '1', 'image' => '1'),
+			array('width' => '10%',  'align' => 'left',   'visible' => '0'),
 			array('width' => '10%', 'align' => 'left',   'visible' => '1'),
-			array('width' => '10%', 'align' => 'left', 'visible' => '1'),
-			array('width' => '5%',  'align' => 'center', 'visible' => '1'),
+			array('width' => '10%', 'align' => 'left',   'visible' => '1'),
+			array('width' => '25%', 'align' => 'left', 'visible' => '1'),
+			array('width' => '5%',  'align' => 'left', 'visible' => '1'),
 			array('width' => '10%', 'align' => 'center', 'visible' => '1'),
 			array('width' => '5%', 'align' => 'center', 'visible' => '1'),
-			array('width' => '5%', 'align' => 'center', 'visible' => '1'),
-			array('width' => '5%', 'align' => 'center', 'visible' => '1'),
+			array('width' => '5%', 'align' => 'center', 'visible' => '0'),
+			array('width' => '5%', 'align' => 'center', 'visible' => '0'),
 			array('width' => '5%',  'align' => 'center', 'visible' => '0'),
 			array('width' => '15%', 'align' => 'center', 'visible' => '1'),
 		);
 		
 		$actions = array(

Vulnerable code: 		$class_method = ucfirst($action) . '_Action';
			array('width' => '5%',  'align' => 'center', 'visible' => '1'),
			array('width' => '10%', 'align' => 'center', 'visible' => '1', 'image' => '1'),
			array('width' => '15%', 'align' => 'center', 'visible' => '1'),
			array('width' => '10%', 'align' => 'center', 'visible' => '1'),
			array('width' => '50%', 'align' => 'center', 'visible' => '1'),
			array('width' => '8%', 'align' => 'left',   'visible' => '1', 'image' => '1'),
			array('width' => '5%',  'align' => 'left',   'visible' => '0'),
			array('width' => '8%', 'align' => 'left',   'visible' => '1'),
			array('width' => '10%', 'align' => 'left', 'visible' => '1'),
			array('width' => '5%',  'align' => 'center', 'visible' => '1'),
			array('width' => '5%', 'align' => 'center', 'visible' => '1'),
			array('width' => '5%', 'align' => 'center', 'visible' => '1'),
Fixed code: 		$class_method = ucfirst(strip_tags($action)) . '_Action';
			array('width' => '10%',  'align' => 'center', 'visible' => '1'),
			array('width' => '15%', 'align' => 'left', 'visible' => '1', 'image' => '1'),
			array('width' => '20%', 'align' => 'left', 'visible' => '1'),
			array('width' => '10%', 'align' => 'left', 'visible' => '1'),
			array('width' => '30%', 'align' => 'left', 'visible' => '1'),
			array('width' => '10%', 'align' => 'left',   'visible' => '1', 'image' => '1'),
			array('width' => '10%',  'align' => 'left',   'visible' => '0'),
			array('width' => '10%', 'align' => 'left',   'visible' => '1'),
			array('width' => '25%', 'align' => 'left', 'visible' => '1'),
			array('width' => '5%',  'align' => 'left', 'visible' => '1'),
			array('width' => '5%', 'align' => 'center', 'visible' => '0'),
			array('width' => '5%', 'align' => 'center', 'visible' => '0'),