CVE-2012-10002: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in ahmyi RivetTracker. It has been declared as problematic. Affected by this vulnerability is the function changeColor of the file css.php. The manipulation of the argument set_css leads to cross site scripting. The attack can be launched remotely. The patch is named 45a0f33876d58cb7e4a0f17da149e58fc893b858. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217267.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-03T09:15Z
Repository: https://github.com/ahmyi/rivettracker
Language: PHP
Files changed: css.php, edit_database.php, sanity.php, sanity_no_output.php, statistics.php
Commit date: 2012-03-13 03:50:51 -0400
Commit message: More security fixes:

css.php
  Unfiltered $_POSTs everywhere!
  Prevent XSS in Create CSS form entry [http://forums.rivetcode.com/viewtopic.php?f=9&t=342&p=1144#p1144]
  Typo in create css file error message.
  Needed to connect to database for cleaning function.

edit_database.php
  One line changed: a simple htmlentities() will take care of this for now.

sanity.php, sanity_no_output.php
  Changed obsolete code, no escape on queries.

statistics.php
  Filtered yet another global array

Diff: diff --git a/css.php b/css.php
index 9fc3d58..4bcec98 100644
--- a/css.php
+++ b/css.php
@@ -9,10 +9,18 @@ if (!$_SESSION['admin_logged_in'])
 {
 	//check fails
 	header("Location: authenticate.php?status=session");
 	exit();
 }
+
+// Prep database, needed for cleaning function
+if ($GLOBALS["persist"])
+	$db = @mysql_pconnect($dbhost, $dbuser, $dbpass) or showError("Can't connect to database. Contact the webmaster.");
+else
+	$db = @mysql_connect($dbhost, $dbuser, $dbpass) or showError("Can't connect to database. Contact the webmaster.");
+@mysql_select_db($database) or showError("Can't open database. Contact the webmaster");
+
 ?>
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 
 <html>
@@ -42,47 +50,47 @@ if (!$_SESSION['admin_logged_in'])
 <?php
 
 if (isset($_POST["set_css"]))
 {
 	//delete style.css file
-	if (copy("./css/" . $_POST["set_css"], "./css/style.css"))
-		echo "<p class=\"success\">style.css file has been replaced with " . $_POST["set_css"] . "</p>";
+	if (copy("./css/" . filterData($_POST["set_css"]), "./css/style.css"))
+		echo "<p class=\"success\">style.css file has been replaced with " . filterData($_POST["set_css"]) . "</p>";
 	else
 	{
 		echo errorMessage() . "Error: Unable to copy over style.css, are the permissions correct?</p>";
 		exit();
 	}
 }
 elseif (isset($_POST["delete_css"]))
 {
 	//delete css file
-	if (unlink("./css/" . $_POST["delete_css"]))
-		echo "<p class=\"success\">" . $_POST["delete_css"] . " has been deleted</p>";
+	if (unlink("./css/" . filterData($_POST["delete_css"])))
+		echo "<p class=\"success\">" . filterData($_POST["delete_css"]) . " has been deleted</p>";
 	else
 	{
-		echo errorMessage() . "Error: Unable to delete " . $_POST["delete_css"] . ", are you sure the permissions are correct?</p>";
+		echo errorMessage() . "Error: Unable to delete " . filterData($_POST["delete_css"]) . ", are you sure the permissions are correct?</p>";
 		exit();
 	}
 }
 elseif (isset($_POST["create_css"]))
 {
 	//create new css file by copying over style.css into new file
 	if (substr($_POST["create_css"], -4) == ".css")
 	{
-		if (!file_exists("./css/" . $_POST["create_css"]))
+		if (!file_exists("./css/" . filterData($_POST["create_css"])))
 		{
-			if (copy("./css/style.css", "./css/" . $_POST["create_css"]))
-				echo "<p class=\"success\">" . $_POST["create_css"] . ", was created successfuly</p>";
+			if (copy("./css/style.css", "./css/" . filterData($_POST["create_css"])))
+				echo "<p class=\"success\">" . filterData($_POST["create_css"]) . ", was created successfuly</p>";
 			else
 			{
-				echo errorMessage() . "Error: Unabled to create " . $_POST["create_css"] . ", are you sure the permissions are correct?</p>";
+				echo errorMessage() . "Error: Unable to create " . filterData($_POST["create_css"]) . ", are you sure the permissions are correct?</p>";
 				exit();			
 			}
 		}
 		else
 		{
-			echo errorMessage() . "Error: " . $_POST["create_css"] . " already exists, please choose a different name</p>";
+			echo errorMessage() . "Error: " . filterData($_POST["create_css"]) . " already exists, please choose a different name</p>";
 			exit();
 		}
 	}
 	else
 	{
@@ -128,13 +136,13 @@ if (isset($_POST["create_css"]) || isset($_POST["edit_css"]))
 	</table>
 	<br>
 	<?php
 	
 	if (isset($_POST["create_css"]))
-		$filename = $_POST["create_css"];
+		$filename = filterData($_POST["create_css"]);
 	if (isset($_POST["edit_css"]))
-		$filename = $_POST["edit_css"];
+		$filename = filterData($_POST["edit_css"]);
 	//display text box with css in it
 	?>
 	<h2>Editing File: <?php echo $filename;?></h2>
 	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
 	<input type="hidden" name="hidden_filename" value="<?php echo $filename;?>"/>
@@ -151,28 +159,28 @@ if (isset($_POST["create_css"]) || isset($_POST["edit_css"]))
 }
 
 if (isset($_POST["file_contents"]))
 {
 	//save previously edited text into file
-	if (is_writable("./css/" . $_POST["hidden_filename"]))
+	if (is_writable("./css/" . filterData($_POST["hidden_filename"])))
 	{
 		//open file
-		$stream = fopen("./css/" . $_POST["hidden_filename"], "w");
-		fwrite($stream, $_POST["file_contents"]);
+		$stream = fopen("./css/" . filterData($_POST["hidden_filename"]), "w");
+		fwrite($stream, filterData($_POST["file_contents"]));
 		fclose($stream);
-		echo "<p class=\"success\">" . $_POST["hidden_filename"] . ", was saved successfuly</p>";
+		echo "<p class=\"success\">" . filterData($_POST["hidden_filename"]) . ", was saved successfuly</p>";
 	}
 	else
 	{
 		echo errorMessage() . "Error: The file cannot be saved, check the permissions</p>";
 		exit();
 	}
 	//if editing the current css file, replace that too
 	if ($_POST["current_css_file"] == $_POST["hidden_filename"])
 	{
-		if (copy("./css/" . $_POST["hidden_filename"], "./css/style.css"))
-			echo "<p class=\"success\">style.css file has been replaced with " . $_POST["hidden_filename"] . "</p>";
+		if (copy("./css/" . filterData($_POST["hidden_filename"]), "./css/style.css"))
+			echo "<p class=\"success\">style.css file has been replaced with " . filterData($_POST["hidden_filename"]) . "</p>";
 		else
 		{
 			echo errorMessage() . "Error: Unable to copy over style.css, are the permissions correct?</p>";
 			exit();
 		}
diff --git a/edit_database.php b/edit_database.php
index fe93523..b55a91d 100644
--- a/edit_database.php
+++ b/edit_database.php
@@ -34,11 +34,11 @@ else
 	$db = mysql_connect($dbhost, $dbuser, $dbpass) or die(errorMessage() . "Tracker error: can't connect to database - " . mysql_error() . "</p>");
 mysql_select_db($database) or die(errorMessage() . "Error selecting database.</p>");
 
 //get filename from URL string
 if (isset($_GET['filename'])) {
-	$filename = $_GET['filename'];
+	$filename = htmlentities($_GET['filename']);
 }
 
 //if not edit database or filename set, display all torrents as links
 if (!isset($_POST["editdatabase"]) && !isset($filename))
 {
diff --git a/sanity.php b/sanity.php
index f38a223..0c59bf3 100644
--- a/sanity.php
+++ b/sanity.php
@@ -137,14 +137,14 @@ while ($row = mysql_fetch_row($results))
 		$where = implode(" OR ", $row);
 		$query = mysql_query("SELECT * FROM ".$prefix."x$hash WHERE $where");
 		
 		while ($row = mysql_fetch_assoc($query))
 		{
-			$compact = mysql_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
-				$peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
-			$no_peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
-			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence=\"{$row["sequence"]}\", compact=\"$compact\", with_peerid=\"$peerid\", without_peerid=\"$no_peerid\"");
+			$compact = mysql_real_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
+			$peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
+			$no_peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
+			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence='{$row["sequence"]}', compact='$compact', with_peerid='$peerid', without_peerid='$no_peerid'");
 		}
 	}	
 	else
 		echo "Added none";
 
diff --git a/sanity_no_output.php b/sanity_no_output.php
index f100a3e..85d9a9e 100644
--- a/sanity_no_output.php
+++ b/sanity_no_output.php
@@ -47,16 +47,16 @@ while ($row = mysql_fetch_row($results))
 		quickQuery("UPDATE ".$prefix."summary SET seeds=".$counts["seeder"]." WHERE info_hash=\"$hash\"");
 		
 	if ($counts["leecher"] == 0)
 	{
 		//If there are no leechers, set the speed to zero
-		quickQuery("UPDATE ".$prefix."summary set speed=0 WHERE info_hash=\"$hash\"");
+		quickQuery("UPDATE ".$prefix."summary set speed=0 WHERE info_hash='$hash'");
 	}
 	
 
 	if ($bytes < 0)
-		quickQuery("UPDATE ".$prefix."summary SET dlbytes=0 WHERE info_hash=\"$hash\"");
+		quickQuery("UPDATE ".$prefix."summary SET dlbytes=0 WHERE info_hash='$hash'");
 
 	myTrashCollector($hash, $report_interval, time(), $writeout);
 
 	$result = mysql_query("SELECT ".$prefix."x$hash.sequence FROM ".$prefix."x$hash LEFT JOIN ".$prefix."y$hash ON ".$prefix."x$hash.sequence = ".$prefix."y$hash.sequence WHERE ".$prefix."y$hash.sequence IS NULL") or die(errorMessage() . "" . mysql_error() . "</p>");
 	if (mysql_num_rows($result) > 0)
@@ -68,14 +68,14 @@ while ($row = mysql_fetch_row($results))
 		$where = implode(" OR ", $row);
 		$query = mysql_query("SELECT * FROM ".$prefix."x$hash WHERE $where");
 		
 		while ($row = mysql_fetch_assoc($query))
 		{
-			$compact = mysql_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
-				$peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
-			$no_peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
-			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence=\"{$row["sequence"]}\", compact=\"$compact\", with_peerid=\"$peerid\", without_peerid=\"$no_peerid\"");
+			$compact = mysql_real_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
+			$peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
+			$no_peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
+			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence='{$row["sequence"]}', compact='$compact', with_peerid='$peerid', without_peerid='$no_peerid'");
 		}
 	}	
 
 	$result = mysql_query("SELECT ".$prefix."y$hash.sequence FROM ".$prefix."y$hash LEFT JOIN ".$prefix."x$hash ON ".$prefix."y$hash.sequence = ".$prefix."x$hash.sequence WHERE ".$prefix."x$hash.sequence IS NULL");
 	if (mysql_num_rows($result) > 0)
@@ -114,13 +114,13 @@ while ($row = mysql_fetch_row($results))
 
 
 function myTrashCollector($hash, $timeout, $now, $writeout)
 {
 	require("config.php");
- 	$peers = loadLostPeers($hash, $timeout);
+	$peers = loadLostPeers($hash, $timeout);
 	for ($i=0; $i < $peers["size"]; $i++) {
 	        killPeer($peers[$i]["peer_id"], $hash, $peers[$i]["bytes"], $peers[$i]);
 	}
  	quickQuery("UPDATE ".$prefix."summary SET lastcycle='$now' WHERE info_hash='$hash'");
 }
 
-?>
+?>
\ No newline at end of file
diff --git a/statistics.php b/statistics.php
index 444ce86..6cea85a 100644
--- a/statistics.php
+++ b/statistics.php
@@ -22,11 +22,11 @@ if (!$_SESSION['admin_logged_in'])
 </head>
 <body>
 <h1>Tracker User Statistics</h1>
 
 <form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="POST">
-Filename Search:<input type="text" name="filename_search" size="40"<?php if (isset($_POST["filename_search"]))echo " value=\"" . $_POST["filename_search"] . "\"";?>>
+Filename Search:<input type="text" name="filename_search" size="40"<?php if (isset($_POST["filename_search"]))echo " value=\"" . filterData($_POST["filename_search"]) . "\"";?>>
 <input type="submit" value="Search">
 </form>
 <br>
 
 <?php

Vulnerable code: 	if (copy("./css/" . $_POST["set_css"], "./css/style.css"))
		echo "<p class=\"success\">style.css file has been replaced with " . $_POST["set_css"] . "</p>";
	if (unlink("./css/" . $_POST["delete_css"]))
		echo "<p class=\"success\">" . $_POST["delete_css"] . " has been deleted</p>";
		echo errorMessage() . "Error: Unable to delete " . $_POST["delete_css"] . ", are you sure the permissions are correct?</p>";
		if (!file_exists("./css/" . $_POST["create_css"]))
			if (copy("./css/style.css", "./css/" . $_POST["create_css"]))
				echo "<p class=\"success\">" . $_POST["create_css"] . ", was created successfuly</p>";
				echo errorMessage() . "Error: Unabled to create " . $_POST["create_css"] . ", are you sure the permissions are correct?</p>";
			echo errorMessage() . "Error: " . $_POST["create_css"] . " already exists, please choose a different name</p>";
		$filename = $_POST["create_css"];
		$filename = $_POST["edit_css"];
	if (is_writable("./css/" . $_POST["hidden_filename"]))
		$stream = fopen("./css/" . $_POST["hidden_filename"], "w");
		fwrite($stream, $_POST["file_contents"]);
		echo "<p class=\"success\">" . $_POST["hidden_filename"] . ", was saved successfuly</p>";
		if (copy("./css/" . $_POST["hidden_filename"], "./css/style.css"))
			echo "<p class=\"success\">style.css file has been replaced with " . $_POST["hidden_filename"] . "</p>";
	$filename = $_GET['filename'];
			$compact = mysql_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
				$peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
			$no_peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence=\"{$row["sequence"]}\", compact=\"$compact\", with_peerid=\"$peerid\", without_peerid=\"$no_peerid\"");
		quickQuery("UPDATE ".$prefix."summary set speed=0 WHERE info_hash=\"$hash\"");
		quickQuery("UPDATE ".$prefix."summary SET dlbytes=0 WHERE info_hash=\"$hash\"");
			$compact = mysql_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
				$peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
			$no_peerid = mysql_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence=\"{$row["sequence"]}\", compact=\"$compact\", with_peerid=\"$peerid\", without_peerid=\"$no_peerid\"");
 	$peers = loadLostPeers($hash, $timeout);
?>
Filename Search:<input type="text" name="filename_search" size="40"<?php if (isset($_POST["filename_search"]))echo " value=\"" . $_POST["filename_search"] . "\"";?>>
Fixed code: 
// Prep database, needed for cleaning function
if ($GLOBALS["persist"])
	$db = @mysql_pconnect($dbhost, $dbuser, $dbpass) or showError("Can't connect to database. Contact the webmaster.");
else
	$db = @mysql_connect($dbhost, $dbuser, $dbpass) or showError("Can't connect to database. Contact the webmaster.");
@mysql_select_db($database) or showError("Can't open database. Contact the webmaster");

	if (copy("./css/" . filterData($_POST["set_css"]), "./css/style.css"))
		echo "<p class=\"success\">style.css file has been replaced with " . filterData($_POST["set_css"]) . "</p>";
	if (unlink("./css/" . filterData($_POST["delete_css"])))
		echo "<p class=\"success\">" . filterData($_POST["delete_css"]) . " has been deleted</p>";
		echo errorMessage() . "Error: Unable to delete " . filterData($_POST["delete_css"]) . ", are you sure the permissions are correct?</p>";
		if (!file_exists("./css/" . filterData($_POST["create_css"])))
			if (copy("./css/style.css", "./css/" . filterData($_POST["create_css"])))
				echo "<p class=\"success\">" . filterData($_POST["create_css"]) . ", was created successfuly</p>";
				echo errorMessage() . "Error: Unable to create " . filterData($_POST["create_css"]) . ", are you sure the permissions are correct?</p>";
			echo errorMessage() . "Error: " . filterData($_POST["create_css"]) . " already exists, please choose a different name</p>";
		$filename = filterData($_POST["create_css"]);
		$filename = filterData($_POST["edit_css"]);
	if (is_writable("./css/" . filterData($_POST["hidden_filename"])))
		$stream = fopen("./css/" . filterData($_POST["hidden_filename"]), "w");
		fwrite($stream, filterData($_POST["file_contents"]));
		echo "<p class=\"success\">" . filterData($_POST["hidden_filename"]) . ", was saved successfuly</p>";
		if (copy("./css/" . filterData($_POST["hidden_filename"]), "./css/style.css"))
			echo "<p class=\"success\">style.css file has been replaced with " . filterData($_POST["hidden_filename"]) . "</p>";
	$filename = htmlentities($_GET['filename']);
			$compact = mysql_real_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
			$peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
			$no_peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence='{$row["sequence"]}', compact='$compact', with_peerid='$peerid', without_peerid='$no_peerid'");
		quickQuery("UPDATE ".$prefix."summary set speed=0 WHERE info_hash='$hash'");
		quickQuery("UPDATE ".$prefix."summary SET dlbytes=0 WHERE info_hash='$hash'");
			$compact = mysql_real_escape_string(pack('Nn', ip2long($row["ip"]), $row["port"]));
			$peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . '7:peer id20:' . hex2bin($row["peer_id"]) . "4:porti{$row["port"]}e");
			$no_peerid = mysql_real_escape_string('2:ip' . strlen($row["ip"]) . ':' . $row["ip"] . "4:porti{$row["port"]}e");
			mysql_query("INSERT INTO ".$prefix."y$hash SET sequence='{$row["sequence"]}', compact='$compact', with_peerid='$peerid', without_peerid='$no_peerid'");
	$peers = loadLostPeers($hash, $timeout);
?>
Filename Search:<input type="text" name="filename_search" size="40"<?php if (isset($_POST["filename_search"]))echo " value=\"" . filterData($_POST["filename_search"]) . "\"";?>>