CVE-2021-39136: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: baserCMS is an open source content management system with a focus on Japanese language support. In affected versions there is a cross-site scripting vulnerability in the file upload function of the management system of baserCMS. Users are advised to update as soon as possible. No workaround are available to mitigate this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-08-25T18:15Z
Repository: https://github.com/baserproject/basercms
Language: PHP
Files changed: app/webroot/theme/admin-third/UploaderFiles/admin/ajax_image.php, lib/Baser/Plugin/Uploader/View/UploaderFiles/admin/ajax_image.php
Commit date: 2021-08-25 21:52:17 +0900
Commit message: Merge pull request from GHSA-hgjr-632x-qpp3


Diff: diff --git a/app/webroot/theme/admin-third/UploaderFiles/admin/ajax_image.php b/app/webroot/theme/admin-third/UploaderFiles/admin/ajax_image.php
index a692c3d269..8bbd939fd7 100755
--- a/app/webroot/theme/admin-third/UploaderFiles/admin/ajax_image.php
+++ b/app/webroot/theme/admin-third/UploaderFiles/admin/ajax_image.php
@@ -3,20 +3,26 @@
  * baserCMS :  Based Website Development Project <https://basercms.net>
  * Copyright (c) baserCMS Users Community <https://basercms.net/community/>
  *
  * @copyright       Copyright (c) baserCMS Users Community
  * @link            https://basercms.net baserCMS Project
- * @package            Uploader.View
+ * @package         Uploader.View
  * @since           baserCMS v 3.0.10
  * @license         https://basercms.net/license/index.html
  */
-$url = $this->BcBaser->getUrl($this->Uploader->getFileUrl($file['UploaderFile']['name']));
+
+/**
+ * @var BcAppView $this
+ * @var array $file
+ * @var string $size
+ */
+$url = h($this->BcBaser->getUrl($this->Uploader->getFileUrl($file['UploaderFile']['name'])));
 ?>
 
 
 <p class="url">
-	<a href="<?php echo $url ?>" target="_blank"><?php echo FULL_BASE_URL . $url ?></a>
+	<a href="<?php echo $url ?>" target="_blank"><?php echo Router::url($url, true) ?></a>
 </p>
 <p class="image">
 	<a href="<?php echo $url ?>"
 	   target="_blank"><?php echo $this->Uploader->file($file, ['size' => $size, 'alt' => $file['UploaderFile']['name']]) ?></a>
 </p>
diff --git a/lib/Baser/Plugin/Uploader/View/UploaderFiles/admin/ajax_image.php b/lib/Baser/Plugin/Uploader/View/UploaderFiles/admin/ajax_image.php
index 87802ecd5e..8bbd939fd7 100755
--- a/lib/Baser/Plugin/Uploader/View/UploaderFiles/admin/ajax_image.php
+++ b/lib/Baser/Plugin/Uploader/View/UploaderFiles/admin/ajax_image.php
@@ -7,16 +7,22 @@
  * @link            https://basercms.net baserCMS Project
  * @package         Uploader.View
  * @since           baserCMS v 3.0.10
  * @license         https://basercms.net/license/index.html
  */
-$url = $this->BcBaser->getUrl($this->Uploader->getFileUrl($file['UploaderFile']['name']));
+
+/**
+ * @var BcAppView $this
+ * @var array $file
+ * @var string $size
+ */
+$url = h($this->BcBaser->getUrl($this->Uploader->getFileUrl($file['UploaderFile']['name'])));
 ?>
 
 
 <p class="url">
-	<a href="<?php echo $url ?>" target="_blank"><?php echo FULL_BASE_URL . $url ?></a>
+	<a href="<?php echo $url ?>" target="_blank"><?php echo Router::url($url, true) ?></a>
 </p>
 <p class="image">
 	<a href="<?php echo $url ?>"
 	   target="_blank"><?php echo $this->Uploader->file($file, ['size' => $size, 'alt' => $file['UploaderFile']['name']]) ?></a>
 </p>

Vulnerable code:  * @package            Uploader.View
$url = $this->BcBaser->getUrl($this->Uploader->getFileUrl($file['UploaderFile']['name']));
	<a href="<?php echo $url ?>" target="_blank"><?php echo FULL_BASE_URL . $url ?></a>
$url = $this->BcBaser->getUrl($this->Uploader->getFileUrl($file['UploaderFile']['name']));
	<a href="<?php echo $url ?>" target="_blank"><?php echo FULL_BASE_URL . $url ?></a>
Fixed code:  * @package         Uploader.View

/**
 * @var BcAppView $this
 * @var array $file
 * @var string $size
 */
$url = h($this->BcBaser->getUrl($this->Uploader->getFileUrl($file['UploaderFile']['name'])));
	<a href="<?php echo $url ?>" target="_blank"><?php echo Router::url($url, true) ?></a>

/**
 * @var BcAppView $this
 * @var array $file
 * @var string $size
 */
$url = h($this->BcBaser->getUrl($this->Uploader->getFileUrl($file['UploaderFile']['name'])));
	<a href="<?php echo $url ?>" target="_blank"><?php echo Router::url($url, true) ?></a>