CVE-2014-125110: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability has been found in wp-file-upload Plugin up to 2.4.3 on WordPress and classified as problematic. Affected by this vulnerability is the function wfu_ajax_action_callback of the file lib/wfu_ajaxactions.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.4 is able to address this issue. The identifier of the patch is c846327df030a0a97da036a2f07c769ab9284ddb. It is recommended to upgrade the affected component. The identifier VDB-258781 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-04-01T00:15Z
Repository: https://github.com/wp-plugins/wp-file-upload
Language: PHP
Files changed: lib/wfu_ajaxactions.php, lib/wfu_functions.php, readme.txt, wordpress_file_upload.php
Commit date: 2014-08-20 11:43:49 +0000
Commit message: new version 2.4.4 - fix XSS issues

git-svn-id: https://plugins.svn.wordpress.org/wp-file-upload/trunk@968920 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/lib/wfu_ajaxactions.php b/lib/wfu_ajaxactions.php
index 7f55779..f4ae0e8 100644
--- a/lib/wfu_ajaxactions.php
+++ b/lib/wfu_ajaxactions.php
@@ -65,23 +65,23 @@ function wfu_ajax_action_callback() {
 	$user = wp_get_current_user();
 	$arr = wfu_get_params_fields_from_index($_POST['params_index']);
 	//check referer using server sessions to avoid CSRF attacks
 	if ( $_SESSION["wfu_token_".$arr['shortcode_id']] != $_POST['session_token'] ) {
 		echo "Session failed!<br/><br/>Session Data:<br/>";
-		print_r($_SESSION);
+		print_r(wfu_sanitize($_SESSION));
 		echo "<br/><br/>Post Data:<br/>";
-		print_r($_POST);
+		print_r(wfu_sanitize($_POST));
 		die();
 	}
 
 	if ( $user->user_login != $arr['user_login'] ) {
 		echo "User failed!<br/><br/>User Data:<br/>";
-		print_r($user);
+		print_r(wfu_sanitize($user));
 		echo "<br/><br/>Post Data:<br/>";
-		print_r($_POST);
+		print_r(wfu_sanitize($_POST));
 		echo "<br/><br/>Params Data:<br/>";
-		print_r($arr);
+		print_r(wfu_sanitize($arr));
 		die();
 	}
 
 	$params_str = get_option('wfu_params_'.$arr['unique_id']);
 	$params = wfu_decode_array_from_string($params_str);
diff --git a/lib/wfu_functions.php b/lib/wfu_functions.php
index 5c3b275..4ad8f3e 100644
--- a/lib/wfu_functions.php
+++ b/lib/wfu_functions.php
@@ -101,10 +101,28 @@ function wfu_array_remove_nulls(&$arr) {
 	foreach ( $arr as $key => $arri )
 		if ( $arri == null )
 			array_splice($arr, $key, 1);
 }
 
+function wfu_safe_array($arr) {
+	return array_map("htmlspecialchars", $arr);
+}
+
+function wfu_sanitize($var) {
+	$typ = gettype($var);
+	if ( $typ == "boolean" || $typ == "integer" || $typ == "double" || $typ == "resource" || $typ == "NULL" )
+		return $var;
+	elseif ( $typ == "string" )
+		return htmlspecialchars($var);
+	elseif ( $typ == "array" || $typ == "object" ) {
+		foreach ( $var as &$item ) $item = wfu_sanitize($item);
+		return $var;
+	}
+	else
+		return $typ;
+}
+
 function wfu_shortcode_string_to_array($shortcode) {
 	function _wfu_preg_replace_callback_alt($contents, $token) {
 		$in_block = false;
 		$prev_pos = 0;
 		$new_contents = '';
diff --git a/readme.txt b/readme.txt
index 6d4605a..9e9fb98 100644
--- a/readme.txt
+++ b/readme.txt
@@ -108,10 +108,13 @@ Administrators can view and manage the uploaded files from the File Browser that
 6. A screenshot of the shortcode composer.
 7. A screenshot of the file browser.
 
 == Changelog ==
 
+= 2.4.4 =
+* intermediate update to make the plugin more immune to hackers
+
 = 2.4.3 =
 * correction of bug to allow uploadpath to receive userdata as parameter
 
 = 2.4.2 =
 * intermediate update to address some vulnerability issues
@@ -311,11 +314,14 @@ Added the option to allow anyone to upload files, by setting the attribute uploa
 = 1.0 =
 Initial version.
 
 == Upgrade Notice ==
 
-= 2.4.2 =
+= 2.4.4 =
+Important upgrade to address some vulnerability issues.
+
+= 2.4.3 =
 Upgrade to address some functionality issues.
 
 = 2.4.2 =
 Important upgrade to address some vulnerability issues.
 
diff --git a/wordpress_file_upload.php b/wordpress_file_upload.php
index 5edb500..d6ace89 100644
--- a/wordpress_file_upload.php
+++ b/wordpress_file_upload.php
@@ -2,11 +2,11 @@
 session_start();
 /*Plugin Name: Wordpress File Upload
 /*
 Plugin URI: http://www.iptanus.com/support/wordpress-file-upload
 Description: Simple interface to upload files from a page.
-Version: 2.4.3
+Version: 2.4.4
 Author: Nickolas Bossinas
 Author URI: http://www.iptanus.com
 */
 
 /*

Vulnerable code: 		print_r($_SESSION);
		print_r($_POST);
		print_r($user);
		print_r($_POST);
		print_r($arr);
= 2.4.2 =
Version: 2.4.3
Fixed code: 		print_r(wfu_sanitize($_SESSION));
		print_r(wfu_sanitize($_POST));
		print_r(wfu_sanitize($user));
		print_r(wfu_sanitize($_POST));
		print_r(wfu_sanitize($arr));
function wfu_safe_array($arr) {
	return array_map("htmlspecialchars", $arr);
}

function wfu_sanitize($var) {
	$typ = gettype($var);
	if ( $typ == "boolean" || $typ == "integer" || $typ == "double" || $typ == "resource" || $typ == "NULL" )
		return $var;
	elseif ( $typ == "string" )
		return htmlspecialchars($var);
	elseif ( $typ == "array" || $typ == "object" ) {
		foreach ( $var as &$item ) $item = wfu_sanitize($item);
		return $var;
	}
	else
		return $typ;
}

= 2.4.4 =
* intermediate update to make the plugin more immune to hackers

= 2.4.4 =
Important upgrade to address some vulnerability issues.

= 2.4.3 =
Version: 2.4.4