CVE-2022-35213: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Ecommerce-CodeIgniter-Bootstrap before commit 56465f was discovered to contain a cross-site scripting (XSS) vulnerability via the function base_url() at /blog/blogpublish.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-08-18T20:15Z
Repository: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap
Language: PHP
Files changed: application/config/config.php, application/modules/admin/views/blog/blogpublish.php
Commit date: 2021-08-21 18:42:26 +0300
Commit message: hot fixes

Diff: diff --git a/application/config/config.php b/application/config/config.php
index 1b8bb76..778a916 100755
--- a/application/config/config.php
+++ b/application/config/config.php
@@ -356,11 +356,11 @@ $config['cache_query_string'] = FALSE;
   | See the user guide for more info.
   |
   | https://codeigniter.com/user_guide/libraries/encryption.html
   |
  */
-$config['encryption_key'] = '';
+$config['encryption_key'] = 'asd';
 
 /*
   |--------------------------------------------------------------------------
   | Session Variables
   |--------------------------------------------------------------------------
@@ -412,11 +412,11 @@ $config['encryption_key'] = '';
   |
  */
 $config['sess_driver'] = 'files';
 $config['sess_cookie_name'] = 'ci_session';
 $config['sess_expiration'] = 7200;
-$config['sess_save_path'] = NULL;
+$config['sess_save_path'] = sys_get_temp_dir();
 $config['sess_match_ip'] = FALSE;
 $config['sess_time_to_update'] = 300;
 $config['sess_regenerate_destroy'] = FALSE;
 
 /*
diff --git a/application/modules/admin/views/blog/blogpublish.php b/application/modules/admin/views/blog/blogpublish.php
index 3c90910..7f873f2 100755
--- a/application/modules/admin/views/blog/blogpublish.php
+++ b/application/modules/admin/views/blog/blogpublish.php
@@ -40,11 +40,11 @@
             }
             ?>
             <div class="form-group">
                 <?php if (isset($_POST['image'])) { ?>
                     <input type="hidden" name="old_image" value="<?= htmlspecialchars($_POST['image']) ?>">
-                    <div><img class="img-responsive" src="<?= base_url('attachments/blog_images/' . $_POST['image']) ?>"></div>
+                    <div><img class="img-responsive" src="<?= base_url('attachments/blog_images/' . htmlspecialchars($_POST['image'])) ?>"></div>
                     <label for="userfile">Choose another image:</label>
                 <?php } else { ?>
                     <label for="userfile">Upload image:</label>
                 <?php } ?>
                 <input type="file" id="userfile" name="userfile">

Vulnerable code: $config['encryption_key'] = '';
$config['sess_save_path'] = NULL;
                    <div><img class="img-responsive" src="<?= base_url('attachments/blog_images/' . $_POST['image']) ?>"></div>
Fixed code: $config['encryption_key'] = 'asd';
$config['sess_save_path'] = sys_get_temp_dir();
                    <div><img class="img-responsive" src="<?= base_url('attachments/blog_images/' . htmlspecialchars($_POST['image'])) ?>"></div>