CVE-2022-0690: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-02-19T17:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Content/Http/Controllers/Admin/ContentController.php, src/MicroweberPackages/Page/Http/Controllers/Admin/PageController.php, src/MicroweberPackages/Post/Http/Controllers/Admin/PostController.php, src/MicroweberPackages/Product/Http/Controllers/Admin/ProductController.php
Commit date: 2022-02-19 17:56:57 +0200
Commit message: update

Diff: diff --git a/src/MicroweberPackages/Content/Http/Controllers/Admin/ContentController.php b/src/MicroweberPackages/Content/Http/Controllers/Admin/ContentController.php
index 63229d64531..c4fa517986b 100644
--- a/src/MicroweberPackages/Content/Http/Controllers/Admin/ContentController.php
+++ b/src/MicroweberPackages/Content/Http/Controllers/Admin/ContentController.php
@@ -34,9 +34,9 @@ class ContentController extends AdminController
     }
 
     public function edit(Request $request, $id) {
 
         return $this->view('content::admin.content.edit', [
-            'content_id'=>$id
+            'content_id'=>intval($id)
         ]);
     }
 }
diff --git a/src/MicroweberPackages/Page/Http/Controllers/Admin/PageController.php b/src/MicroweberPackages/Page/Http/Controllers/Admin/PageController.php
index 855bbe10398..928b163682c 100644
--- a/src/MicroweberPackages/Page/Http/Controllers/Admin/PageController.php
+++ b/src/MicroweberPackages/Page/Http/Controllers/Admin/PageController.php
@@ -30,9 +30,9 @@ class PageController extends AdminController
     }
 
     public function edit(Request $request, $id) {
 
         return $this->view('page::admin.page.edit', [
-            'content_id'=>$id
+            'content_id'=>intval($id)
         ]);
     }
 }
diff --git a/src/MicroweberPackages/Post/Http/Controllers/Admin/PostController.php b/src/MicroweberPackages/Post/Http/Controllers/Admin/PostController.php
index 3cf6a29b130..3e7d999171c 100644
--- a/src/MicroweberPackages/Post/Http/Controllers/Admin/PostController.php
+++ b/src/MicroweberPackages/Post/Http/Controllers/Admin/PostController.php
@@ -32,9 +32,9 @@ class PostController extends AdminController
     }
 
     public function edit(Request $request, $id) {
 
         return $this->view('post::admin.posts.edit', [
-            'content_id'=>$id
+            'content_id'=>intval($id)
         ]);
     }
 }
diff --git a/src/MicroweberPackages/Product/Http/Controllers/Admin/ProductController.php b/src/MicroweberPackages/Product/Http/Controllers/Admin/ProductController.php
index fe705f40293..93406504095 100644
--- a/src/MicroweberPackages/Product/Http/Controllers/Admin/ProductController.php
+++ b/src/MicroweberPackages/Product/Http/Controllers/Admin/ProductController.php
@@ -30,9 +30,9 @@ class ProductController extends AdminController
     }
 
     public function edit(Request $request, $id) {
 
         return $this->view('product::admin.product.edit', [
-            'content_id'=>$id
+            'content_id'=>intval($id)
         ]);
     }
 }

Vulnerable code:             'content_id'=>$id
            'content_id'=>$id
            'content_id'=>$id
            'content_id'=>$id
Fixed code:             'content_id'=>intval($id)
            'content_id'=>intval($id)
            'content_id'=>intval($id)
            'content_id'=>intval($id)