CVE-2014-125031: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in kirill2485 TekNet. It has been classified as problematic. Affected is an unknown function of the file pages/loggedin.php. The manipulation of the argument statusentery leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 1c575340539f983333aa43fc58ecd76eb53e1816. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217176.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-02T08:15Z
Repository: https://github.com/kirill2485/TekNet
Language: PHP
Files changed: index.php, login.php, pages/loggedin.php, version.php
Commit date: 2014-11-19 05:49:23 +0000
Commit message: Fixed an SQL injection vulnerability in loggedin.php

Diff: diff --git a/images/theteknet.png b/images/theteknet.png
new file mode 100644
index 0000000..1815725
Binary files /dev/null and b/images/theteknet.png differ
diff --git a/index.php b/index.php
index c6f7eef..36af344 100644
--- a/index.php
+++ b/index.php
@@ -7,11 +7,11 @@ if($email != null){
 }
 ?>
 
 <html lang="en" class="no-js">
 	<head>
-		<title>TekNet Beta Registration</title>
+		<title>Beta Registration</title>
 		<meta name="description" content="TekNet Beta registration" />
 		<link rel="shortcut icon" href="../favicon.ico"> 
 		<link rel="stylesheet" type="text/css" href="css/default.css" />
 		<link rel="stylesheet" type="text/css" href="css/component.css" />
 		<link rel="stylesheet" type="text/css" href="css/menu.css">
@@ -23,11 +23,13 @@ if($email != null){
 			<!-- Top Navigation -->
 <center><img src="images/Octocat.png" width="30" height="30">Attention: We are now availible on GitHub. Download us at <a href="https://github.com/kirill2485/TekNet">github.com/kirill2485/TekNet</a>.</center>
 	<a href="#"><hr></a>
 			<header>
 					<div class="inner relative">
+						<img src="images/theteknet.png">
 <div style=height:20px; padding-top:50px;"></div>
+
 			<a id="menu-toggle" class="button dark" href="#""></i></a>
 			<nav id="navigation">
 				<ul id="main-menu">
 					<li class="parent">
 						<a href="login.php">Sign in</a>
@@ -38,16 +40,16 @@ if($email != null){
 					</li>
 				</ul>
 			</nav>
 			<div class="clear"></div>
 		</div>
-				<h1>TekNet Beta Registration <span> Register to be one of the first beta users on our site</h1>	
+				<h1>Beta Registration <span> Register to be one of the first beta users on our site</h1>	
 			</header>
-			<section class="color-1">
 				<p class="text note-touch">Sign-ups are currrently closed. You may try using the demo version of the site by clicking "Sign in" at the top right corner, and using the provided demo account. Please enter your email and name to pre-register and receive updates on TekNet's progress.</p>
 				<p>
-				Please make sure you are over the age of 13, as it would be illegal for us to knowingly collect information from people under the age of 13. Registration is open to PAUSD students only. Scroll down for all of the FAQ's.
+		<br>
+					Please make sure you are over the age of 13, as it would be illegal for us to knowingly collect information from people under the age of 13. Registration is open to PAUSD students only. Scroll down for all of the FAQ's.
 				<p>
 <form method="get">
 
     Email:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <input type="text" name="email">
     <br>
@@ -55,21 +57,19 @@ if($email != null){
     <br>
     <input type="submit" button class="btn btn-1 btn-1a" value="Submit">
 </form >
 
 <?php
-
 $email = $_GET["email"];
 $name = $_GET["name"];
 $position = strpos($email,"@palo-alto.edu");
 if ($position==false && $email!=null){
     echo "<font color='red'>Sorry, you must enter your @palo-alto.edu address to pre-register. To do this, please head over to <a href=\"http://palo-alto.edu\">http://palo-alto.edu</a>, enter in your username and password as you normally would for Schoology, click \"Google Apps\", go to Gmail, and click on your profile on the top right corner of Gmail. This would show your @palo-alto.org email. For help with this, or if you go to a PAUSD school, but don't have an @palo-alto.edu account, please contact support@theteknet.com</font>";
 }
 elseif($email==null){
     echo "Enter your @palo-alto.edu email and your name.";
 }
-
 else{
     echo "Gotcha, we will be contacting you at $email shortly. To unsubscribe, just send an email to support@theteknet.org with the word \"Unsubscribe\" in the subject line, and we will be more then happy to remove your email from recieving updates";
     
 mysqli_query($con,"INSERT INTO userinfo (email, name) VALUES ('$email','$name')");
 }
@@ -77,11 +77,14 @@ mysqli_query($con,"INSERT INTO userinfo (email, name) VALUES ('$email','$name')"
 ?>
 </section>
 			<section class="color-2">
 			<h1>What is TekNet?</h1>
 			TekNet is a social network created by a group of Gunn studends designed for ALL PAUSD students ages 13+. TekNet will help PAUSD students connect, make friends (especially new students), find common classes, and get help with homework.
+			<br>
+			
 			</section>
+			
 						<section class="color-3">
 			<h1>When is TekNet going to be released?</h1>
 			TekNet has no public release schedule at this time. TekNet's release depends on the demand of users that have pre-registered. If we receive at least 45 pre-registration requests, we will be released around late December to early January.
 			</section>
 			<section class="color-4">
diff --git a/login.php b/login.php
index 4359541..2bf9a78 100644
--- a/login.php
+++ b/login.php
@@ -13,13 +13,13 @@ session_start();
 	<body>
 		<div class="container">
 			<!-- Top Navigation -->
 
 			<header>
-
+<a href="index.php"><img src="images/theteknet.png"></a>
 			<div class="clear"></div>
-				<h1>TekNet Login <span>Welcome back, please login</h1>	
+				<h1>Login <span>Welcome back, please login</h1>	
 			</header>
 			<section class="color-1">
 				<p class="text note-touch">Please enter your email and password. <br>To try out this site as a demo user, please login as email: jsmith@palo-alto.edu, password: demouser</p>
 				<p>
 				<form action method="post">
diff --git a/pages/loggedin.php b/pages/loggedin.php
index 218513a..a4c8c06 100644
--- a/pages/loggedin.php
+++ b/pages/loggedin.php
@@ -2,17 +2,20 @@
 <html lang="en" class="no-js">
 	<head>
 <title>TekNet - Home</title>
 
 </head>
+
 			<?php
 include '../includeme.php';
 include '../getelement.php';
 include '../backendstuff/phplogin.php';
 
 ?>
+
 <header>
+	<center><img src="../images/theteknet.png"></center>
 				<?php 
 				echo "<h1>TekNet - Home  </h1> <span>Welcome back, $email </span>";
 				?>
 			</header>
 			<section class="color-1">
@@ -32,13 +35,18 @@ $result=$con->query("SELECT name FROM registeredusers WHERE email='$email'");
 $name=$result->fetch_row();
 $_SESSION['name'] = $name[0];
 
 $namestatus=$con->query("SELECT name,message,postnum FROM status ORDER BY postnum");
 $statusentery = $_POST[status];
+$position = strpos($statusentery,"<");
+if ($position === 0){
+	echo "Sorry, for security purposes we do not allow characters such as <";
+	exit;
+}
 if ($statusentery != null){
 if ($con->query("INSERT INTO status(message, name, date, postnum) VALUES('$statusentery', '$name[0]', now(), 2)") === TRUE) {
-    echo "Buzz posted";
+    echo "<script>document.location.href='http://www.theteknet.com'</script>";
 }
 else {
     echo "Error: " . $sql . "<br>" . $con->error;
 }
 }
@@ -71,6 +79,7 @@ echo "<br>";
 }
 echo $name[0];
 
 
 ?>
+<br>
 </body>
\ No newline at end of file
diff --git a/version.php b/version.php
index 2fe77f5..1f7c016 100644
--- a/version.php
+++ b/version.php
@@ -1,3 +1,3 @@
 <html>
-	TheTekNet Version 0.05 Alpha
+	TheTekNet Version 0.09 Alpha -- Codename: Mentos
 </html>
\ No newline at end of file

Vulnerable code: 		<title>TekNet Beta Registration</title>
				<h1>TekNet Beta Registration <span> Register to be one of the first beta users on our site</h1>	
			<section class="color-1">
				Please make sure you are over the age of 13, as it would be illegal for us to knowingly collect information from people under the age of 13. Registration is open to PAUSD students only. Scroll down for all of the FAQ's.



				<h1>TekNet Login <span>Welcome back, please login</h1>	
    echo "Buzz posted";
	TheTekNet Version 0.05 Alpha
Fixed code: 		<title>Beta Registration</title>
						<img src="images/theteknet.png">

				<h1>Beta Registration <span> Register to be one of the first beta users on our site</h1>	
		<br>
					Please make sure you are over the age of 13, as it would be illegal for us to knowingly collect information from people under the age of 13. Registration is open to PAUSD students only. Scroll down for all of the FAQ's.
			<br>
			
			
<a href="index.php"><img src="images/theteknet.png"></a>
				<h1>Login <span>Welcome back, please login</h1>	


	<center><img src="../images/theteknet.png"></center>
$position = strpos($statusentery,"<");
if ($position === 0){
	echo "Sorry, for security purposes we do not allow characters such as <";
	exit;
}
    echo "<script>document.location.href='http://www.theteknet.com'</script>";
<br>
	TheTekNet Version 0.09 Alpha -- Codename: Mentos