CVE-2012-10004: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in backdrop-contrib Basic Cart on Drupal. It has been classified as problematic. Affected is the function basic_cart_checkout_form_submit of the file basic_cart.cart.inc. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.x-1.1.1 is able to address this issue. The patch is identified as a10424ccd4b3b4b433cf33b73c1ad608b11890b4. It is recommended to upgrade the affected component. VDB-217950 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-11T07:15Z
Repository: https://github.com/backdrop-contrib/basic_cart
Language: PHP
Files changed: basic_cart.admin.inc, basic_cart.cart.inc, basic_cart_cart_render.tpl.php, basic_cart_cart_render_block.tpl.php
Commit date: 2012-01-31 17:16:38 +0100
Commit message: XSS issue, drupal mail instead of mail system

Diff: diff --git a/basic_cart.admin.inc b/basic_cart.admin.inc
index b813cab..3f1aed8 100644
--- a/basic_cart.admin.inc
+++ b/basic_cart.admin.inc
@@ -23,11 +23,11 @@ function basic_cart_admin_content_type() {
     '#title' => t('Content type selection'),
     '#type' => 'fieldset',
     '#description' => t('Please select the content types for which you wish to have the "Add to cart" option.'),
   );
 
-  $form['content_type']['types'] = array(
+  $form['content_type']['basic_cart_content_types'] = array(
     '#title' => t('Content types'),
     '#type' => 'checkboxes',
     '#options' => $options,
     '#default_value' => variable_get('basic_cart_content_types', array()),
   );
@@ -36,38 +36,38 @@ function basic_cart_admin_content_type() {
     '#title' => t('Email messages'),
     '#type' => 'fieldset',
     '#description' => t('Here you can customize the mails sent to the site administrator and customer, after an order is placed.'),
   );
 
-  $form['messages']['admin_subject'] = array(
+  $form['messages']['basic_cart_admin_subject'] = array(
     '#title' => t('Subject'),
     '#type' => 'textfield',
     '#description' => t("Subject field for the administrator's email."),
     '#default_value' => variable_get('basic_cart_admin_subject'),
   );
 
-  $form['messages']['admin_message'] = array(
+  $form['messages']['basic_cart_admin_message'] = array(
     '#title' => t('Admin email'),
     '#type' => 'textarea',
     '#description' => t('This email will be sent to the site administrator just after an order is placed. Availabale tokes: %CUSTOMER_NAME, %CUSTOMER_EMAIL, %CUSTOMER_PHONE, %CUSTOMER_ADDRESS, %CUSTOMER_MESSAGE, %ORDER_DETAILS'),
     '#default_value' => variable_get('basic_cart_admin_message'),
   );
 
-  $form['messages']['send_user_message'] = array(
+  $form['messages']['basic_cart_send_user_message'] = array(
     '#title' => t('Send an email to the customer after an order is placed'),
     '#type' => 'checkbox',
     '#default_value' => variable_get('basic_cart_send_user_message'),
   );
 
-  $form['messages']['user_subject'] = array(
+  $form['messages']['basic_cart_user_subject'] = array(
     '#title' => t('Subject'),
     '#type' => 'textfield',
     '#description' => t("Subject field for the user's email."),
     '#default_value' => variable_get('basic_cart_user_subject'),
   );
 
-  $form['messages']['user_message'] = array(
+  $form['messages']['basic_cart_user_message'] = array(
     '#title' => t('User email'),
     '#type' => 'textarea',
     '#description' => t('This email will be sent to the user just after an order is placed. Availabale tokes: %CUSTOMER_NAME, %CUSTOMER_EMAIL, %CUSTOMER_PHONE, %CUSTOMER_ADDRESS, %CUSTOMER_MESSAGE, %ORDER_DETAILS'),
     '#default_value' => variable_get('basic_cart_user_message'),
   );
@@ -76,59 +76,21 @@ function basic_cart_admin_content_type() {
     '#title' => t('Thank you page'),
     '#type' => 'fieldset',
     '#description' => t('Here you can customize the thank you page.'),
   );
 
-  $form['thank_you']['thank_you_title'] = array(
+  $form['thank_you']['basic_cart_thank_you_title'] = array(
     '#title' => t('Title'),
     '#type' => 'textfield',
     '#description' => t('Thank you page title.'),
     '#default_value' => variable_get('basic_cart_thank_you_title'),
   );
 
-  $form['thank_you']['thank_you_message'] = array(
+  $form['thank_you']['basic_cart_thank_you_message'] = array(
     '#title' => t('Text'),
     '#type' => 'textarea',
     '#description' => t('Thank you page text.'),
     '#default_value' => variable_get('basic_cart_thank_you_message'),
   );
 
-  $form['save'] = array(
-    '#type' => 'submit',
-    '#value' => t('Save configuration'),
-  );
-
-  return $form;
-}
-
-
-/**
- * Callback for the admin configuration page submit function
- */
-function basic_cart_admin_content_type_submit($form_id, $form_state) {
-  $types = $form_state['values']['types'];
-  $selected_types = array();
-  foreach ($types as $type) {
-    if (!empty($type)) {
-      $selected_types[] = $type;
-    }
-  }
-
-  // Content types.
-  variable_set('basic_cart_content_types', $selected_types);
-
-  // Admin message.
-  variable_set('basic_cart_admin_message', $form_state['values']['admin_message']);
-  variable_set('basic_cart_admin_subject', $form_state['values']['admin_subject']);
-
-  // User message.
-  variable_set('basic_cart_send_user_message', $form_state['values']['send_user_message']);
-  variable_set('basic_cart_user_message', $form_state['values']['user_message']);
-  variable_set('basic_cart_user_subject', $form_state['values']['user_subject']);
-
-  // Thank you message.
-  variable_set('basic_cart_thank_you_title', $form_state['values']['thank_you_title']);
-  variable_set('basic_cart_thank_you_message', $form_state['values']['thank_you_message']);
-
-  // Message.
-  drupal_set_message(t('The configuration options have been saved.'));
+  return system_settings_form($form);
 }
diff --git a/basic_cart.cart.inc b/basic_cart.cart.inc
index b7efd1f..59813be 100644
--- a/basic_cart.cart.inc
+++ b/basic_cart.cart.inc
@@ -234,51 +234,33 @@ function basic_cart_checkout_form_submit($form, &$form_state) {
   );
 
   // Admin mail.
   $message_html = variable_get('basic_cart_admin_message');
   $message_html = str_replace($search, $replace, $message_html);
+  $params['admin_message'] = filter_xss($message_html);
+
+  $site_mail = variable_get('site_mail');
 
   // Sending mail.
-  $my_module = 'basic_cart';
-  $my_mail_token = 'checkout';
-  $from = variable_get('site_mail');
-
-  $message = array(
-    'id' => $my_module . '_' . $my_mail_token,
-    'to' => $from,
-    'subject' => variable_get('basic_cart_admin_subject'),
-    'body' => $message_html,
-    'headers' => array(
-      'From' => $from,
-      'Sender' => $from,
-      'Return-Path' => $from,
-    ),
-  );
-  $system = drupal_mail_system($my_module, $my_mail_token);
+  $message = drupal_mail('basic_cart', 'admin_mail', $site_mail, language_default(), $params);
+
   $mails_sent = 0;
-  if ($system->mail($message)) {
+  if ($message['result']) {
     $mails_sent++;
   }
+  
   // User email.
   $send_user_mail = variable_get('basic_cart_send_user_message');
   if ($send_user_mail) {
     $message_html = variable_get('basic_cart_user_message');
     $message_html = str_replace($search, $replace, $message_html);
+    $params['user_message'] = filter_xss($message_html);
 
-    $message = array(
-      'id' => $my_module . '_' . $my_mail_token,
-      'to' => $form_state['values']['basic_cart_checkout_email'],
-      'subject' => variable_get('basic_cart_user_subject'),
-      'body' => $message_html,
-      'headers' => array(
-        'From' => $from,
-        'Sender' => $from,
-        'Return-Path' => $from,
-      ),
-    );
-    $system = drupal_mail_system($my_module, $my_mail_token);
-    if ($system->mail($message)) {
+    // Sending mail.
+    $message = drupal_mail('basic_cart', 'user_mail', $form_state['values']['basic_cart_checkout_email'], language_default(), $params);
+
+    if ($message['result']) {
       $mails_sent++;
     }
   }
 
   if ($mails_sent == 2) {
@@ -288,14 +270,32 @@ function basic_cart_checkout_form_submit($form, &$form_state) {
   else {
     drupal_set_message(t('There was a problem in submitting your order. Please try again later.'), 'error');
   }
 }
 
+
+/**
+ * Implements hook_mail().
+ */
+function basic_cart_mail($key, &$message, $params) {
+  switch($key) {
+    case 'admin_mail':
+      $message['subject'] = check_plain(variable_get('basic_cart_admin_subject'));
+      $message['body'][] = $params['admin_message'];
+      break;
+
+    case 'user_mail':
+      $message['subject'] = check_plain(variable_get('basic_cart_user_subject'));
+      $message['body'][] = $params['user_message'];
+      break;
+  }
+}
+
 /**
  * Callback for thank you page.
  */
 function basic_cart_checkout_thank_you() {
   $title = variable_get('basic_cart_thank_you_title');
   drupal_set_title($title);
   $message = variable_get('basic_cart_thank_you_message');
-  return nl2br($message);
+  return nl2br(filter_xss($message));
 }
diff --git a/basic_cart_cart_render.tpl.php b/basic_cart_cart_render.tpl.php
index 816ff3c..0ce7409 100644
--- a/basic_cart_cart_render.tpl.php
+++ b/basic_cart_cart_render.tpl.php
@@ -1,10 +1,11 @@
 <?php
 /**
  * @file
  * Basic cart shopping cart html template
  */
+
 ?>
 
 <?php if( empty($cart) ): ?>
   <p><?php print t('Your shopping cart is empty.'); ?></p>
 <?php else: ?>
@@ -34,11 +35,19 @@
               </span>
             </div>
           
             <?php if(!$is_checkout): ?>
               <div class="basic-cart-delete-image cell">
-                <?php print l('<img src="' . $base_path . drupal_get_path('module', 'basic_cart') . '/images/delete.gif" border="0" />', 'cart/remove/' . $nid, array('html' => TRUE)); ?>
+                <?php 
+                $variables = array(
+                  'path' => $base_path . drupal_get_path('module', 'basic_cart') . '/images/delete.gif',
+                  'alt' => t('Remove from cart'),
+                  'title' => t('Remove from cart'),
+                  'attributes' => array('class' => 'basic-cart-delete-image-image'),
+                );
+                print l(theme('image', $variables), 'cart/remove/' . $nid, array('html' => TRUE));
+                ?>
               </div>
             <?php endif; ?>
         </div>
       <?php endforeach; ?>
       <?php if(!$is_checkout): ?>
diff --git a/basic_cart_cart_render_block.tpl.php b/basic_cart_cart_render_block.tpl.php
index ad37dd0..8969661 100644
--- a/basic_cart_cart_render_block.tpl.php
+++ b/basic_cart_cart_render_block.tpl.php
@@ -1,10 +1,11 @@
 <?php
 /**
  * @file
  * Basic cart shopping cart block
  */
+
 ?>
 
 <?php if( empty($cart) ): ?>
   <p><?php print t('Your cart is empty.'); ?></p>
 <?php else: ?>

Vulnerable code:   $form['content_type']['types'] = array(
  $form['messages']['admin_subject'] = array(
  $form['messages']['admin_message'] = array(
  $form['messages']['send_user_message'] = array(
  $form['messages']['user_subject'] = array(
  $form['messages']['user_message'] = array(
  $form['thank_you']['thank_you_title'] = array(
  $form['thank_you']['thank_you_message'] = array(
  $form['save'] = array(
    '#type' => 'submit',
    '#value' => t('Save configuration'),
  );

  return $form;
}


/**
 * Callback for the admin configuration page submit function
 */
function basic_cart_admin_content_type_submit($form_id, $form_state) {
  $types = $form_state['values']['types'];
  $selected_types = array();
  foreach ($types as $type) {
    if (!empty($type)) {
      $selected_types[] = $type;
    }
  }

  // Content types.
  variable_set('basic_cart_content_types', $selected_types);

  // Admin message.
  variable_set('basic_cart_admin_message', $form_state['values']['admin_message']);
  variable_set('basic_cart_admin_subject', $form_state['values']['admin_subject']);

  // User message.
  variable_set('basic_cart_send_user_message', $form_state['values']['send_user_message']);
  variable_set('basic_cart_user_message', $form_state['values']['user_message']);
  variable_set('basic_cart_user_subject', $form_state['values']['user_subject']);

  // Thank you message.
  variable_set('basic_cart_thank_you_title', $form_state['values']['thank_you_title']);
  variable_set('basic_cart_thank_you_message', $form_state['values']['thank_you_message']);

  // Message.
  drupal_set_message(t('The configuration options have been saved.'));
  $my_module = 'basic_cart';
  $my_mail_token = 'checkout';
  $from = variable_get('site_mail');

  $message = array(
    'id' => $my_module . '_' . $my_mail_token,
    'to' => $from,
    'subject' => variable_get('basic_cart_admin_subject'),
    'body' => $message_html,
    'headers' => array(
      'From' => $from,
      'Sender' => $from,
      'Return-Path' => $from,
    ),
  );
  $system = drupal_mail_system($my_module, $my_mail_token);
  if ($system->mail($message)) {
    $message = array(
      'id' => $my_module . '_' . $my_mail_token,
      'to' => $form_state['values']['basic_cart_checkout_email'],
      'subject' => variable_get('basic_cart_user_subject'),
      'body' => $message_html,
      'headers' => array(
        'From' => $from,
        'Sender' => $from,
        'Return-Path' => $from,
      ),
    );
    $system = drupal_mail_system($my_module, $my_mail_token);
    if ($system->mail($message)) {
  return nl2br($message);
                <?php print l('<img src="' . $base_path . drupal_get_path('module', 'basic_cart') . '/images/delete.gif" border="0" />', 'cart/remove/' . $nid, array('html' => TRUE)); ?>
Fixed code:   $form['content_type']['basic_cart_content_types'] = array(
  $form['messages']['basic_cart_admin_subject'] = array(
  $form['messages']['basic_cart_admin_message'] = array(
  $form['messages']['basic_cart_send_user_message'] = array(
  $form['messages']['basic_cart_user_subject'] = array(
  $form['messages']['basic_cart_user_message'] = array(
  $form['thank_you']['basic_cart_thank_you_title'] = array(
  $form['thank_you']['basic_cart_thank_you_message'] = array(
  return system_settings_form($form);
  $params['admin_message'] = filter_xss($message_html);

  $site_mail = variable_get('site_mail');
  $message = drupal_mail('basic_cart', 'admin_mail', $site_mail, language_default(), $params);

  if ($message['result']) {
  
    $params['user_message'] = filter_xss($message_html);
    // Sending mail.
    $message = drupal_mail('basic_cart', 'user_mail', $form_state['values']['basic_cart_checkout_email'], language_default(), $params);

    if ($message['result']) {

/**
 * Implements hook_mail().
 */
function basic_cart_mail($key, &$message, $params) {
  switch($key) {
    case 'admin_mail':
      $message['subject'] = check_plain(variable_get('basic_cart_admin_subject'));
      $message['body'][] = $params['admin_message'];
      break;

    case 'user_mail':
      $message['subject'] = check_plain(variable_get('basic_cart_user_subject'));
      $message['body'][] = $params['user_message'];
      break;
  }
}

  return nl2br(filter_xss($message));

                <?php 
                $variables = array(
                  'path' => $base_path . drupal_get_path('module', 'basic_cart') . '/images/delete.gif',
                  'alt' => t('Remove from cart'),
                  'title' => t('Remove from cart'),
                  'attributes' => array('class' => 'basic-cart-delete-image-image'),
                );
                print l(theme('image', $variables), 'cart/remove/' . $nid, array('html' => TRUE));
                ?>