CVE-2014-4742: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in system/class_link.php in the System module (module_system) in Kajona before 4.5 allows remote attackers to inject arbitrary web script or HTML via the systemid parameter in a mediaFolder action to index.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-07-09T14:55Z
Repository: https://github.com/kajona/kajonacms
Language: PHP
Files changed: module_system/system/class_link.php
Commit date: 2014-06-08 21:55:30 +0200
Commit message: BUG / SECURITY: module_system | class_link -> fixed some rare conditions where a possible xss injection was possible for the systemid-param

Diff: diff --git a/module_system/system/class_link.php b/module_system/system/class_link.php
index 7bf0f2424..4badfcae6 100644
--- a/module_system/system/class_link.php
+++ b/module_system/system/class_link.php
@@ -345,14 +345,16 @@ class class_link {
         if($strPageI == "" && $strPageE != "")
             $bitInternal = false;
 
 
         //create an array out of the params
-        $strParsedSystemid = "";
-        $arrParams = self::parseParamsString($strParams, $strParsedSystemid);
-        if($strSystemid == "" && validateSystemid($strParsedSystemid))
-            $strSystemid = $strParsedSystemid;
+        if($strSystemid != "") {
+            $strParams .= "&systemid=".$strSystemid;
+            $strSystemid = "";
+        }
+
+        $arrParams = self::parseParamsString($strParams, $strSystemid);
 
         // any anchors set to the page?
         $strAnchor = "";
         if(uniStrpos($strPageI, "#") !== false) {
             //get anchor, remove anchor from link
@@ -494,11 +496,15 @@ class class_link {
         $arrParams = explode("&", $strParams);
         foreach($arrParams as $strKey => &$strValue) {
             $arrEntry = explode("=", $strValue);
 
             if(count($arrEntry) == 2 && $arrEntry[0] == "systemid") {
-                $strSystemid = $arrEntry[1];
+                //encoded and sanitized systemid param TODO: add cve number or other identifier
+                $strSystemid = urlencode($arrEntry[1]);
+                if(!validateSystemid($strSystemid))
+                    $strSystemid = "";
+
                 unset($arrParams[$strKey]);
             }
             else if($strValue == "")
                 unset($arrParams[$strKey]);
 

Vulnerable code:         $strParsedSystemid = "";
        $arrParams = self::parseParamsString($strParams, $strParsedSystemid);
        if($strSystemid == "" && validateSystemid($strParsedSystemid))
            $strSystemid = $strParsedSystemid;
                $strSystemid = $arrEntry[1];
Fixed code:         if($strSystemid != "") {
            $strParams .= "&systemid=".$strSystemid;
            $strSystemid = "";
        }

        $arrParams = self::parseParamsString($strParams, $strSystemid);
                //encoded and sanitized systemid param TODO: add cve number or other identifier
                $strSystemid = urlencode($arrEntry[1]);
                if(!validateSystemid($strSystemid))
                    $strSystemid = "";