CVE-2016-10969: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The supportflow plugin before 0.7 for WordPress has XSS via a discussion ticket title.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-09-16T13:15Z
Repository: https://github.com/SupportFlow/supportflow
Language: PHP
Files changed: classes/class-supportflow-admin.php
Commit date: 2016-06-20 22:26:17 +0000
Commit message: Admin: Escape ticket title on Discussion screen to avoid XSS.

If `run_wptexturize` is disabled, the following subject title would allow an attacker to perform cross-site scripting:

`"><script>alert('hi');</script>`

That attack has a CVSS score of 4.7 - https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

The rest of the output was reformatted to improve readability and make it easier to spot missing escaping functions or other problems.

Props https://hackerone.com/whitehatter for discovering and disclosing responsibly.

Fixes https://hackerone.com/reports/145086

Diff: diff --git a/classes/class-supportflow-admin.php b/classes/class-supportflow-admin.php
index 9387cdd..e4ff6b4 100644
--- a/classes/class-supportflow-admin.php
+++ b/classes/class-supportflow-admin.php
@@ -897,16 +897,29 @@ class SupportFlow_Admin {
 
 	/**
 	 * A box that appears at the top
 	 */
 	public function meta_box_subject() {
+		?>
+
+		<h4><?php _e( 'Subject', 'supportflow' ); ?></h4>
 
-		$placeholder = __( 'What is your conversation about?', 'supportflow' );
-		echo '<h4>' . __( 'Subject', 'supportflow' ) . '</h4>';
-		echo '<input type="text" id="subject" name="post_title" class="sf_autosave" placeholder="' . $placeholder . '" value="' . get_the_title() . '" autocomplete="off" />';
-		echo '<p class="description">' . __( 'Please describe what this ticket is about in several words', 'supportflow' ) . '</p>';
+		<input
+			type="text"
+			id="subject"
+			name="post_title"
+			class="sf_autosave"
+			placeholder="<?php _e( 'What is your conversation about?', 'supportflow' ); ?>"
+			value="<?php echo esc_attr( get_the_title() ); ?>"
+			autocomplete="off"
+		/>
 
+		<p class="description">
+			<?php _e( 'Please describe what this ticket is about in several words', 'supportflow' ) ?>
+		</p>
+
+		<?php
 	}
 
 	/**
 	 * Add a form element where the user can change the customers
 	 */

Vulnerable code: 		$placeholder = __( 'What is your conversation about?', 'supportflow' );
		echo '<h4>' . __( 'Subject', 'supportflow' ) . '</h4>';
		echo '<input type="text" id="subject" name="post_title" class="sf_autosave" placeholder="' . $placeholder . '" value="' . get_the_title() . '" autocomplete="off" />';
		echo '<p class="description">' . __( 'Please describe what this ticket is about in several words', 'supportflow' ) . '</p>';
Fixed code: 		?>

		<h4><?php _e( 'Subject', 'supportflow' ); ?></h4>
		<input
			type="text"
			id="subject"
			name="post_title"
			class="sf_autosave"
			placeholder="<?php _e( 'What is your conversation about?', 'supportflow' ); ?>"
			value="<?php echo esc_attr( get_the_title() ); ?>"
			autocomplete="off"
		/>
		<p class="description">
			<?php _e( 'Please describe what this ticket is about in several words', 'supportflow' ) ?>
		</p>

		<?php