CVE-2022-0926: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-03-12T10:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Utils/System/Files.php
Commit date: 2022-03-11 12:04:52 +0200
Commit message: Update Files.php

Diff: diff --git a/src/MicroweberPackages/Utils/System/Files.php b/src/MicroweberPackages/Utils/System/Files.php
index 037f5950017b..12b120ab4a88 100644
--- a/src/MicroweberPackages/Utils/System/Files.php
+++ b/src/MicroweberPackages/Utils/System/Files.php
@@ -832,14 +832,266 @@ class Files
             'xbap',        //    XAML Browser Application File',
             'xlm',        //    Excel Macro',
             'xqt',        //    SuperCalc Macro File',
             'xys',        //    XYplorer Script File',
             'zl9',        //    ZoneAlarm Quarantined EXE File
-
-
             'swf',        //    Flash File
 
+            'key',
+            'asax',
+            'btapp',
+            'xd',
+            'fwtemplate',
+            'crdownload',
+            'whtt',
+            'ssp',
+            'fmp',
+            'jspa',
+            'obml16',
+            'a5w',
+            'crt',
+            'vrt',
+            'website',
+            'p7c',
+            'dll',
+            'php',
+            'mjs',
+            'dhtml',
+            'xul',
+            'bml',
+            'download',
+            'cshtml',
+            'vsdisco',
+            'codasite',
+            'webbookmark',
+            'rjs',
+            'wsdl',
+            'dml',
+            'aro',
+            'dcr',
+            'shtml',
+            'dochtml',
+            'dwt',
+            'spc',
+            'a4p',
+            'htaccess',
+            'ascx',
+            'pac',
+            'p7b',
+            'xhtm',
+            'oam',
+            'site',
+            'kit',
+            'aspx',
+            'zul',
+            'tpl',
+            'htm',
+            'seam',
+            'svr',
+            'pem',
+            'url',
+            'dap',
+            'appcache',
+            'chm',
+            'wbs',
+            'htc',
+            'ewp',
+            'gsp',
+            'asr',
+            'der',
+            'master',
+            'stc',
+            'ap',
+            'html',
+            'p12',
+            'xpd',
+            'fwp',
+            'epibrw',
+            'strm',
+            'xss',
+            'node',
+            'disco',
+            'gsp',
+            'pro',
+            'rss',
+            'gne',
+            'sdb',
+            'compressed',
+            'asp',
+            'browser',
+            'php2',
+            'sites2',
+            'dothtml',
+            'bok',
+            'axd',
+            'nzb',
+            'vdw',
+            'obml',
+            'mhtml',
+            'ashx',
+            'con',
+            'rhtml',
+            'alx',
+            'opml',
+            'web',
+            'chat',
+            'csr',
+            'do',
+            'sht',
+            'asa',
+            'cha',
+            'h5p',
+            'qf',
+            'olp',
+            'hyperesources',
+            'sparkle',
+            'razor',
+            'php4',
+            'cms',
+            'mml',
+            'jnlp',
+            'har',
+            'br',
+            'webloc',
+            'srf',
+            'cer',
+            'uhtml',
+            'pptmhtml',
+            'phtml',
+            'xbel',
+            'cfm',
+            'fwtemplateb',
+            'jspx',
+            'jsp',
+            'xfdl',
+            'zhtml',
+            'stml',
+            'jsonl',
+            'maff',
+            'dbm',
+            'aex',
+            'crl',
+            'mht',
+            'wml',
+            'sass',
+            'xht',
+            'awm',
+            'page',
+            'hdml',
+            'webmanifest',
+            'itms',
+            'sitemap',
+            'shtm',
+            'wpp',
+            'jss',
+            'oth',
+            'ucf',
+            'prf',
+            'freeway',
+            'edge',
+            'iqy',
+            'vrml',
+            'mvc',
+            'wdgt',
+            'discomap',
+            'psp',
+            'hxs',
+            'adr',
+            'hype',
+            'csp',
+            'xhtml',
+            'webarchive',
+            'qbo',
+            'jhtml',
+            'svc',
+            'phtm',
+            'rw3',
+            'tpl',
+            'stl',
+            'wbxml',
+            'p7',
+            'ndjson',
+            'ognc',
+            'fwtb',
+            'muse',
+            'vbd',
+            'sites',
+            'rt',
+            'esproj',
+            'private',
+            'srl',
+            'zhtml',
+            'vbhtml', 
+            'hypetemplate',
+            'obml15',
+            'hypesymbol',
+            'pub',
+            'ece',
+            'mspx',
+            'docmhtml',
+            'xws',
+            'wgp',
+            'tvpi',
+            'woa',
+            'asmx',
+            'xbl',
+            'webhistory',
+            'idc',
+            'jws',
+            'lbc',
+            'att',
+            'tvvi',
+            'zvz',
+            'php3',
+            'webarchivexml',
+            'widget',
+            'swz',
+            'qrm',
+            'bwp',
+            'atom',
+            'cdf',
+            'map',
+            'hdm',
+            'php5',
+            'rwsw',
+            'wgt',
+            'nod',
+            'rflw',
+            'htx',
+            'mvr',
+            'an',
+            'rwp',
+            'lasso',
+            'vlp',
+            'stp',
+            'nxg',
+            'faces',
+            'kcmsf',
+            'ptw',
+            'less',
+            'saveddeck',
+            'ccbjs',
+            'wn',
+            'ppthtml',
+            'jcz',
+            'jvs',
+            'rwtheme',
+            'jst',
+            'mapx',
+            'cpg',
+            'wpx',
+            'qbx',
+            'suck',
+            'iwdgt',
+            'public',
+            'cphd',
+            'moz',
+            'zfo',
+            'stm',
+            'fcgi',
+            'itpc',
+            'cfml'
         );
 
 
         return $dangerous;
     }

Fixed code:             'key',
            'asax',
            'btapp',
            'xd',
            'fwtemplate',
            'crdownload',
            'whtt',
            'ssp',
            'fmp',
            'jspa',
            'obml16',
            'a5w',
            'crt',
            'vrt',
            'website',
            'p7c',
            'dll',
            'php',
            'mjs',
            'dhtml',
            'xul',
            'bml',
            'download',
            'cshtml',
            'vsdisco',
            'codasite',
            'webbookmark',
            'rjs',
            'wsdl',
            'dml',
            'aro',
            'dcr',
            'shtml',
            'dochtml',
            'dwt',
            'spc',
            'a4p',
            'htaccess',
            'ascx',
            'pac',
            'p7b',
            'xhtm',
            'oam',
            'site',
            'kit',
            'aspx',
            'zul',
            'tpl',
            'htm',
            'seam',
            'svr',
            'pem',
            'url',
            'dap',
            'appcache',
            'chm',
            'wbs',
            'htc',
            'ewp',
            'gsp',
            'asr',
            'der',
            'master',
            'stc',
            'ap',
            'html',
            'p12',
            'xpd',
            'fwp',
            'epibrw',
            'strm',
            'xss',
            'node',
            'disco',
            'gsp',
            'pro',
            'rss',
            'gne',
            'sdb',
            'compressed',
            'asp',
            'browser',
            'php2',
            'sites2',
            'dothtml',
            'bok',
            'axd',
            'nzb',
            'vdw',
            'obml',
            'mhtml',
            'ashx',
            'con',
            'rhtml',
            'alx',
            'opml',
            'web',
            'chat',
            'csr',
            'do',
            'sht',
            'asa',
            'cha',
            'h5p',
            'qf',
            'olp',
            'hyperesources',
            'sparkle',
            'razor',
            'php4',
            'cms',
            'mml',
            'jnlp',
            'har',
            'br',
            'webloc',
            'srf',
            'cer',
            'uhtml',
            'pptmhtml',
            'phtml',
            'xbel',
            'cfm',
            'fwtemplateb',
            'jspx',
            'jsp',
            'xfdl',
            'zhtml',
            'stml',
            'jsonl',
            'maff',
            'dbm',
            'aex',
            'crl',
            'mht',
            'wml',
            'sass',
            'xht',
            'awm',
            'page',
            'hdml',
            'webmanifest',
            'itms',
            'sitemap',
            'shtm',
            'wpp',
            'jss',
            'oth',
            'ucf',
            'prf',
            'freeway',
            'edge',
            'iqy',
            'vrml',
            'mvc',
            'wdgt',
            'discomap',
            'psp',
            'hxs',
            'adr',
            'hype',
            'csp',
            'xhtml',
            'webarchive',
            'qbo',
            'jhtml',
            'svc',
            'phtm',
            'rw3',
            'tpl',
            'stl',
            'wbxml',
            'p7',
            'ndjson',
            'ognc',
            'fwtb',
            'muse',
            'vbd',
            'sites',
            'rt',
            'esproj',
            'private',
            'srl',
            'zhtml',
            'vbhtml', 
            'hypetemplate',
            'obml15',
            'hypesymbol',
            'pub',
            'ece',
            'mspx',
            'docmhtml',
            'xws',
            'wgp',
            'tvpi',
            'woa',
            'asmx',
            'xbl',
            'webhistory',
            'idc',
            'jws',
            'lbc',
            'att',
            'tvvi',
            'zvz',
            'php3',
            'webarchivexml',
            'widget',
            'swz',
            'qrm',
            'bwp',
            'atom',
            'cdf',
            'map',
            'hdm',
            'php5',
            'rwsw',
            'wgt',
            'nod',
            'rflw',
            'htx',
            'mvr',
            'an',
            'rwp',
            'lasso',
            'vlp',
            'stp',
            'nxg',
            'faces',
            'kcmsf',
            'ptw',
            'less',
            'saveddeck',
            'ccbjs',
            'wn',
            'ppthtml',
            'jcz',
            'jvs',
            'rwtheme',
            'jst',
            'mapx',
            'cpg',
            'wpx',
            'qbx',
            'suck',
            'iwdgt',
            'public',
            'cphd',
            'moz',
            'zfo',
            'stm',
            'fcgi',
            'itpc',
            'cfml'