CVE-2023-6890: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.17.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-12-16T09:15Z
Repository: https://github.com/thorsten/phpmyfaq
Language: PHP
Files changed: phpmyfaq/src/phpMyFAQ/Helper/FaqHelper.php, phpmyfaq/src/phpMyFAQ/Helper/SearchHelper.php
Commit date: 2023-07-27 08:02:56 +0200
Commit message: fix: added missing conversion to HTML entities

Diff: diff --git a/phpmyfaq/src/phpMyFAQ/Helper/FaqHelper.php b/phpmyfaq/src/phpMyFAQ/Helper/FaqHelper.php
index 438a17babd8..4863ba4f05d 100644
--- a/phpmyfaq/src/phpMyFAQ/Helper/FaqHelper.php
+++ b/phpmyfaq/src/phpMyFAQ/Helper/FaqHelper.php
@@ -185,15 +185,20 @@ class FaqHelper extends Helper
 
         if (count($faq->faqRecords)) {
             $lastCategory = 0;
             foreach ($faq->faqRecords as $data) {
                 if ($data['category_id'] !== $lastCategory) {
-                    $output .= sprintf('<h3>%s</h3>', $category->getPath($data['category_id'], ' &raquo; '));
+                    $output .= sprintf(
+                        '<h3>%s</h3>',
+                        $this->cleanUpContent(
+                            $this->cleanUpContent($category->getPath($data['category_id'], ' &raquo; '))
+                        )
+                    );
                 }
 
                 $output .= sprintf('<h4>%s</h4>', Strings::htmlentities($data['title']));
-                $output .= sprintf('<article>%s</article>', $data['content']);
+                $output .= sprintf('<article>%s</article>', $this->cleanUpContent($data['content']));
                 $output .= sprintf(
                     '<p>%s: %s<br>%s',
                     $PMF_LANG['msgAuthor'],
                     Strings::htmlentities($data['author']),
                     $PMF_LANG['msgLastUpdateArticle'] . $date->format($data['updated'])
diff --git a/phpmyfaq/src/phpMyFAQ/Helper/SearchHelper.php b/phpmyfaq/src/phpMyFAQ/Helper/SearchHelper.php
index 0cc69406da5..ff2f09397d4 100644
--- a/phpmyfaq/src/phpMyFAQ/Helper/SearchHelper.php
+++ b/phpmyfaq/src/phpMyFAQ/Helper/SearchHelper.php
@@ -256,18 +256,18 @@ class SearchHelper extends Helper
                     $result->lang,
                     urlencode($searchTerm)
                 );
 
                 $oLink = new Link($currentUrl, $this->config);
-                $oLink->text = $question;
-                $oLink->itemTitle = $oLink->tooltip = $result->question;
+                $oLink->text = Strings::htmlentities($question);
+                $oLink->itemTitle = $oLink->tooltip = Strings::htmlentities($result->question);
 
                 $html .= '<li>';
                 $html .= $this->renderScore($result->score * 33);
                 $html .= sprintf(
                     '<strong>%s</strong>: %s<br>',
-                    $categoryInfo[0]['name'],
+                    Strings::htmlentities($categoryInfo[0]['name']),
                     $oLink->toHtmlAnchor()
                 );
                 $html .= sprintf(
                     "<small class=\"searchpreview\"><strong>%s</strong> %s...</small>\n",
                     $this->translation['msgSearchContent'],

Vulnerable code:                     $output .= sprintf('<h3>%s</h3>', $category->getPath($data['category_id'], ' &raquo; '));
                $output .= sprintf('<article>%s</article>', $data['content']);
                $oLink->text = $question;
                $oLink->itemTitle = $oLink->tooltip = $result->question;
                    $categoryInfo[0]['name'],
Fixed code:                     $output .= sprintf(
                        '<h3>%s</h3>',
                        $this->cleanUpContent(
                            $this->cleanUpContent($category->getPath($data['category_id'], ' &raquo; '))
                        )
                    );
                $output .= sprintf('<article>%s</article>', $this->cleanUpContent($data['content']));
                $oLink->text = Strings::htmlentities($question);
                $oLink->itemTitle = $oLink->tooltip = Strings::htmlentities($result->question);
                    Strings::htmlentities($categoryInfo[0]['name']),