CVE-2022-2174: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-06-22T12:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php
Commit date: 2022-06-22 14:56:16 +0300
Commit message: update

Diff: diff --git a/userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php b/userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php
index 1380f7a31203..a6bc6821ccda 100644
--- a/userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php
+++ b/userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php
@@ -85,15 +85,17 @@
     <?php
     $autoSize = true;
     if (isset($_GET['autosize'])) {
         $autoSize = $_GET['autosize'];
     }
+    $autoSize = xss_clean($autoSize);
 
     $type = '';
     if (isset($_GET['type'])) {
         $type = $_GET['type'];
     }
+    $type = xss_clean($type);
 
     $mod_id = $mod_orig_id = false;
     $is_linked_mod = false;
 
     if (isset($params['id'])) {
@@ -401,11 +403,13 @@
             var settings_container_mod_el = $('#settings-container');
             mw.options.form(settings_container_mod_el, function () {
                 if (mw.notification) {
                     mw.notification.success('<?php _ejs('Settings are saved') ?>');
                 }
+                <?php if (isset($params['id'])) : ?>
                 mw.reload_module_parent('#<?php print $params['id']  ?>')
+                <?php endif; ?>
 
             });
 
             createAutoHeight()
         };
@@ -438,13 +442,15 @@
 
 </head>
 <body class="mw-external-loading loading">
 <div id="settings-main">
     <div id="settings-container">
-        <div class="mw-module-live-edit-settings <?php print $params['id'] ?>"
-             id="module-id-<?php print $params['id'] ?>">{content}
-        </div>
+        <?php if (isset($params['id'])) : ?>
+            <div class="mw-module-live-edit-settings <?php print $params['id'] ?>"
+                 id="module-id-<?php print $params['id'] ?>">{content}
+            </div>
+        <?php endif; ?>
     </div>
 </div>
 
 
 <form method="get" id="mw_reload_this_module_popup_form" style="display:none">

Vulnerable code:         <div class="mw-module-live-edit-settings <?php print $params['id'] ?>"
             id="module-id-<?php print $params['id'] ?>">{content}
        </div>
Fixed code:     $autoSize = xss_clean($autoSize);
    $type = xss_clean($type);
                <?php if (isset($params['id'])) : ?>
                <?php endif; ?>
        <?php if (isset($params['id'])) : ?>
            <div class="mw-module-live-edit-settings <?php print $params['id'] ?>"
                 id="module-id-<?php print $params['id'] ?>">{content}
            </div>
        <?php endif; ?>