CVE-2015-1562: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to admin/user_management.php, (2) data_search parameter to /admin/profile_data.php, or (3) filter parameter to error_log.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-02-09T11:59Z
Repository: https://github.com/sauruscms/Saurus-CMS-Community-Edition
Language: PHP
Files changed: admin/error_log.php, admin/profile_data.php, classes/user_html.inc.php
Commit date: 2015-01-27 21:26:28 +0100
Commit message: Fix multiple XSS reflection vulnerabilities

discovered by Steffen Rösemann <steffen.roesemann1986@gmail.com>.

Diff: diff --git a/admin/error_log.php b/admin/error_log.php
index 7a39f86..dd58286 100644
--- a/admin/error_log.php
+++ b/admin/error_log.php
@@ -101,20 +101,23 @@ $lopp_aeg = $site->fdat['lopp']? $site->fdat['lopp'] : date("d.m.Y");
         <td width="100%"></td>
 
 
 		<?###### search box ######?>
 		<form id="searchform" name="searchform" action="<?=$site->self?>" method="GET">
-	<? foreach($site->fdat as $fdat_field=>$fdat_value) { ?>
+	<? foreach($site->fdat as $fdat_field=>$fdat_value) {
+	$fdat_value = htmlspecialchars(xss_clean($fdat_value));
+	$fdat_field = htmlspecialchars(xss_clean($fdat_field)); 
+	?>
 		<input type=hidden name="<?=$fdat_field?>" value="<?=$fdat_value?>">
 	<? } ?>
 		<input type="hidden" name="otsi" value=1>
 		<input type="hidden" name="page" value=""><?# if search smth => reset page number to 1 (Bug #1697)?>
 
 		
 		<td style="padding-right: 10px">
 			<? $search_str = $site->sys_sona(array(sona => "otsi", tyyp=>"editor")); ?>
-	          <input name="filter" type="text" class="scms_flex_input" style="width:150px" value="<?=$site->fdat['filter']? $site->fdat['filter'] : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" onkeyup="javascript: if(event.keyCode==13){this.form.submit();}">
+	          <input name="filter" type="text" class="scms_flex_input" style="width:150px" value="<?=$site->fdat['filter']? htmlspecialchars(xss_clean($site->fdat['filter'])) : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" onkeyup="javascript: if(event.keyCode==13){this.form.submit();}">
 
 		</td>
 
 		<?########## starting + cal ?>
 
diff --git a/admin/profile_data.php b/admin/profile_data.php
index c6c58f1..36398ab 100644
--- a/admin/profile_data.php
+++ b/admin/profile_data.php
@@ -171,18 +171,18 @@ else { $parent_id = $site->alias("system");}
 	  <form name="datasearchform" action="<?=$site->self?>" method="GET">
 								<TR>
 									<TD width="24" nowrap><IMG SRC="<?=$site->CONF['wwwroot'].$site->CONF['styles_path']?>/gfx/menu/search.gif" BORDER="0" ALT="">
 
 									</TD>
-									<TD><input name="data_search" type="text" class="scms_flex_input" value="<?=$site->fdat['data_search']? $site->fdat['data_search'] : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" style="width:140px"></TD>
+									<TD><input name="data_search" type="text" class="scms_flex_input" value="<?=$site->fdat['data_search']? htmlspecialchars(xss_clean($site->fdat['data_search'])) : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" style="width:140px"></TD>
 									<?###### wide middle cell ######?>
 									<td width="100%"></td>
 
 								</TR>
 		<? ######## hidden ########?>
-		<input type=hidden name=profile_search value="<?=$site->fdat['profile_search']?>">
-		<input type=hidden name=profile_id value="<?=$site->fdat['profile_id']?>">
+		<input type=hidden name=profile_search value="<?=htmlspecialchars(xss_clean($site->fdat['profile_search']))?>">
+		<input type=hidden name=profile_id value="<?=htmlspecialchars(xss_clean($site->fdat['profile_id']))?>">
 		</form>
 						</TABLE>
 			<!-- //Search -->
 			<br />
 			</td>
diff --git a/classes/user_html.inc.php b/classes/user_html.inc.php
index b15d97e..55dd639 100644
--- a/classes/user_html.inc.php
+++ b/classes/user_html.inc.php
@@ -619,10 +619,15 @@ function print_search_box(){
 	####### default values
 	$site->fdat['search_subtree'] = isset($site->fdat['search_subtree']) ? $site->fdat['search_subtree'] : "1";
 	$site->fdat['user_search'] = isset($site->fdat['user_search']) ? $site->fdat['user_search'] : "1";
 	$site->fdat['group_search'] = isset($site->fdat['group_search']) ? $site->fdat['group_search'] : "1";
 
+	$site->fdat['search_subtree'] = htmlspecialchars(xss_clean($site->fdat['search_subtree']));
+	$site->fdat['user_search'] = htmlspecialchars(xss_clean($site->fdat['user_search']));
+	$site->fdat['group_search'] = htmlspecialchars(xss_clean($site->fdat['group_search']));
+	$site->fdat['search'] = htmlspecialchars(xss_clean($site->fdat['search']));
+
 	$out = '
 			<!-- Search -->
 						<TABLE width="100%" border="0" cellpadding="0" cellspacing="0" bgcolor=white style="padding-left:4; padding-right:4; padding-top:2">
 	  <form name="searchform" action="'.$site->self.'" method="GET">
 								<TR>

Vulnerable code: 	<? foreach($site->fdat as $fdat_field=>$fdat_value) { ?>
	          <input name="filter" type="text" class="scms_flex_input" style="width:150px" value="<?=$site->fdat['filter']? $site->fdat['filter'] : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" onkeyup="javascript: if(event.keyCode==13){this.form.submit();}">
									<TD><input name="data_search" type="text" class="scms_flex_input" value="<?=$site->fdat['data_search']? $site->fdat['data_search'] : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" style="width:140px"></TD>
		<input type=hidden name=profile_search value="<?=$site->fdat['profile_search']?>">
		<input type=hidden name=profile_id value="<?=$site->fdat['profile_id']?>">
Fixed code: 	<? foreach($site->fdat as $fdat_field=>$fdat_value) {
	$fdat_value = htmlspecialchars(xss_clean($fdat_value));
	$fdat_field = htmlspecialchars(xss_clean($fdat_field)); 
	?>
	          <input name="filter" type="text" class="scms_flex_input" style="width:150px" value="<?=$site->fdat['filter']? htmlspecialchars(xss_clean($site->fdat['filter'])) : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" onkeyup="javascript: if(event.keyCode==13){this.form.submit();}">
									<TD><input name="data_search" type="text" class="scms_flex_input" value="<?=$site->fdat['data_search']? htmlspecialchars(xss_clean($site->fdat['data_search'])) : $search_str.':'?>" onFocus="if(this.value=='<?=$search_str?>:') this.value='';" onBlur="if(this.value=='')this.value='<?=$search_str?>:';" style="width:140px"></TD>
		<input type=hidden name=profile_search value="<?=htmlspecialchars(xss_clean($site->fdat['profile_search']))?>">
		<input type=hidden name=profile_id value="<?=htmlspecialchars(xss_clean($site->fdat['profile_id']))?>">
	$site->fdat['search_subtree'] = htmlspecialchars(xss_clean($site->fdat['search_subtree']));
	$site->fdat['user_search'] = htmlspecialchars(xss_clean($site->fdat['user_search']));
	$site->fdat['group_search'] = htmlspecialchars(xss_clean($site->fdat['group_search']));
	$site->fdat['search'] = htmlspecialchars(xss_clean($site->fdat['search']));