CVE-2012-10003: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in ahmyi RivetTracker. This issue affects some unknown processing. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The patch is named f053c5cc2bc44269b0496b5f275e349928a92ef9. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217271.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-03T12:15Z
Repository: https://github.com/ahmyi/rivettracker
Language: PHP
Files changed: DumpTorrentCGI.php, batch_upload.php, css.php, deleter.php, edit_database.php, editconfig.php, install.php, newtorrents.php, statistics.php
Commit date: 2012-03-02 23:15:07 -0600
Commit message: encase $_SERVER['PHP_SELF'] with htmlentities() to prevent XSS attacks

Diff: diff --git a/DumpTorrentCGI.php b/DumpTorrentCGI.php
index 6ed0b52..6d26d18 100644
--- a/DumpTorrentCGI.php
+++ b/DumpTorrentCGI.php
@@ -22,11 +22,11 @@ require_once("torrent_functions.php");
 ?>
 <table width="50%" border=0><tr><td>
 This script parses a torrent file and displays detailed information about it.
 </td></tr>
 </table><br>
-<form enctype="multipart/form-data" method="POST" action="<?php echo $_SERVER["PHP_SELF"]; ?>">
+<form enctype="multipart/form-data" method="POST" action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>">
 Torrent file: <input type="file" name="torrent" size="40"><br>
 <br>
 OR
 <br><br>
 Torrent URL: <input type=text name="url" size="50"><br><br>
diff --git a/batch_upload.php b/batch_upload.php
index a04ac56..99fb335 100644
--- a/batch_upload.php
+++ b/batch_upload.php
@@ -188,11 +188,11 @@ else
 	
 	<?php
 	if (function_exists("zip_open"))
 	{
 		?>
-		<form enctype="multipart/form-data" action="<?php echo $_SERVER["PHP_SELF"];?>" method="post">
+		<form enctype="multipart/form-data" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
 		<b>Zip File:</b><input type="file" name="zipfile" size="50"/>
 		<input type="submit" value="Upload ZIP File"/>
 		</form>
 		<?php
 	}
diff --git a/css.php b/css.php
index 262ab25..9fc3d58 100644
--- a/css.php
+++ b/css.php
@@ -134,11 +134,11 @@ if (isset($_POST["create_css"]) || isset($_POST["edit_css"]))
 	if (isset($_POST["edit_css"]))
 		$filename = $_POST["edit_css"];
 	//display text box with css in it
 	?>
 	<h2>Editing File: <?php echo $filename;?></h2>
-	<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="post">
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
 	<input type="hidden" name="hidden_filename" value="<?php echo $filename;?>"/>
 	<input type="hidden" name="current_css_file" value="<?php echo $_POST['current_css_file'];?>"/>
 	<textarea name="file_contents" cols="120" rows="20"><?php
 	//open css file
 	readfile("./css/" . $filename);
@@ -201,11 +201,11 @@ if (!isset($_POST["create_css"]) && !isset($_POST["edit_css"]) && !isset($_POST[
 		closedir($dh);
 	}
 	echo "<b>Currently Used CSS File: " . $current_css_file . "</b><br><br>";
 	?>
 	
-	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
 	<b>Set CSS File:</b><select name="set_css">
 	<?php
 	for ($i = 0; $i < $number_files; $i++)
 	{
 		if ($files_array[$i] != $current_css_file) //no point setting it to itself...
@@ -215,11 +215,11 @@ if (!isset($_POST["create_css"]) && !isset($_POST["edit_css"]) && !isset($_POST[
 	</select>
 	<input type="submit" value="Set CSS File"/>
 	</form>
 	<br><br>
 	
-	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post"> 
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post"> 
 	<b>Delete CSS File:</b><select name="delete_css">
 	<?php
 	for ($i = 0; $i < $number_files; $i++)
 	{
 		if ($files_array[$i] != $current_css_file) //can't delete the file if it's already being used...
@@ -229,11 +229,11 @@ if (!isset($_POST["create_css"]) && !isset($_POST["edit_css"]) && !isset($_POST[
 	</select>
 	<input type="submit" value="Delete CSS File"/>
 	</form>
 	<br><br>
 	
-	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
 	<input type="hidden" name="current_css_file" value="<?php echo $current_css_file;?>"/>
 	<b>Edit Existing CSS File:</b><select name="edit_css">
 	<?php
 	for ($i = 0; $i < $number_files; $i++)
 	{
@@ -243,11 +243,11 @@ if (!isset($_POST["create_css"]) && !isset($_POST["edit_css"]) && !isset($_POST[
 	</select>
 	<input type="submit" value="Edit CSS File"/>
 	</form>
 	<br><br>
 	
-	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post"> 
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post"> 
 	<b>Create New CSS File (e.g. mycssfile.css):</b>
 	<input type="text" size="40" name="create_css"/>
 	<input type="submit" value="Create New CSS File"/>
 	</form>
 	<?php
diff --git a/deleter.php b/deleter.php
index ca3a027..735cc7e 100644
--- a/deleter.php
+++ b/deleter.php
@@ -34,11 +34,11 @@ if (!$_SESSION['admin_logged_in'])
     		el.className = Style;
 	}
 	</script>
 </head>
 <body>
-<form action="<?php echo $_SERVER["PHP_SELF"];?>"  method="POST">
+<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>"  method="POST">
 <?php
 require_once("funcsv2.php");
 
 // check database user
 if (isset($dbuser) && isset($dbpass))
diff --git a/edit_database.php b/edit_database.php
index c5b92c0..fe93523 100644
--- a/edit_database.php
+++ b/edit_database.php
@@ -49,11 +49,11 @@ if (!isset($_POST["editdatabase"]) && !isset($filename))
 	$query = "SELECT filename FROM ".$prefix."namemap ORDER BY filename ASC";
 	$rows = mysql_query($query) or die(errorMessage() . "Can't do SQL query - " . mysql_error() . "</p>");
 	
 	while ($data = mysql_fetch_row($rows))
 	{
-		echo "<tr><td><a href=\"" . $PHP_SELF . "?filename=" . rawurlencode($data[0]) . "\">" . $data[0] . "</a></td></tr>\n";
+		echo "<tr><td><a href=\"" . htmlentities($_SERVER['PHP_SELF']) . "?filename=" . rawurlencode($data[0]) . "\">" . $data[0] . "</a></td></tr>\n";
 	}
 	?>
 	</table>
 	<?php
 }
@@ -63,11 +63,11 @@ if (isset($filename) && !isset($_POST["editdatabase"]))
 	$query = "SELECT info_hash,filename,url,pubDate FROM ".$prefix."namemap WHERE filename = '" . mysql_real_escape_string($filename) . "'";
 	$rows = mysql_query($query) or die(errorMessage() . "Can't do SQL query - " . mysql_error() . "</p>");
 	
 	$data = mysql_fetch_row($rows); //should be only one entry...
 	?>
-	<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="POST">
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="POST">
 	<input type="hidden" name="editdatabase" value="1">
 	<input type="hidden" name="<?php echo $data[0];?>" value="<?php echo $data[0];?>">
 	<input type="hidden" name="<?php echo $data[0] . "_old_filename";?>" value="<?php echo $data[1];?>">
 	<table border="0">
 	<tr><td><b>Info Hash: </b></td><td><?php echo $data[0];?></td></tr>
diff --git a/editconfig.php b/editconfig.php
index 06edd79..f3dd893 100644
--- a/editconfig.php
+++ b/editconfig.php
@@ -22,11 +22,11 @@ if (!$_SESSION['admin_logged_in'])
 //open up config file and display for editing
 if (!isset($_POST["saveconfig"]))
 {
 	?>
 	<h1>Edit Config File</h1>
-	<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="POST">
+	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="POST">
 	<input type="hidden" name="saveconfig" value="1">
 	<h2>This page allows you to configure the "config.php" settings.  This file stores all the necessary
 	settings for your tracker.  Please do NOT edit the "config.php" file directly, 
 	use this admin page for any changes.</h2>
 	<h2><span class="notice">*</span> - required value</h2>
diff --git a/install.php b/install.php
index c07c282..5957482 100644
--- a/install.php
+++ b/install.php
@@ -90,11 +90,11 @@ exit;
 			exit();
 		}
 
 		?>
 		<br>
-		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
+		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
 		<input type="hidden" name="started" value="1">
 		<h2>The MySQL database needs to be prepared for the tracker. This script will help
 		you do that.</h2>
 		<h2>You have two choices:</h2>
 		<ul>
@@ -113,11 +113,11 @@ exit;
 		</body></html><?php exit;
 	}
 	if (isset($_POST["preexisting"]))
 	{
 		?>
-		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
+		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
 		<input type="hidden" name="maketables" value="1">
 		<input type="hidden" name="started" value="1">
 		<h1>RivetTracker Installation</h1>
 		<center>
 		<img src="images/install.png" border="0" class="icon" alt="RivetTracker Installation" title="RivetTracker Installation" />
@@ -140,11 +140,11 @@ exit;
 
 	}
 	if (isset($_POST["makeaccount"]))
 	{
 		?>
-		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
+		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
 		<input type="hidden" name="domakeaccount" value="1">
 		<input type="hidden" name="started" value="1">
 		<h1>Tracker Installation</h1>
 		<center>
 		<img src="images/install.png" border="0" class="icon" alt="RivetTracker Installation" title="RivetTracker Installation" />
@@ -229,11 +229,11 @@ exit;
 
 	if (isset($_POST["domakeaccount"]) || isset($_POST["maketables"]))
 	{
 		//have user set values for config.php
 		?>
-		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
+		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
 		<input type="hidden" name="config" value="1">
 		<input type="hidden" name="started" value="1">
 		<?php
 		echo "<input type=\"hidden\" name=\"dbhost\" value=\"" . $hostname . "\">\n";
 		echo "<input type=\"hidden\" name=\"dbuser\" value=\"" . $username . "\">\n";
@@ -595,11 +595,11 @@ exit;
 		{
 			?>
 			<h2>"config.php" was unable to be created on the server, 
 			you will have to download the file and upload it manually.</h2>
 			<br>
-			<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
+			<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
 			<input type="hidden" name="download" value="1">
 			<input type="hidden" name="hiddentracker" value="<?php if (isset($_POST['hiddentracker']) AND $_POST['hiddentracker'] == 'on') echo 'true'; else echo 'false';?>">
 			<input type="hidden" name="scrape" value="<?php if (isset($_POST['scrape']) AND $_POST['scrape'] == 'on') echo 'true'; else echo 'false';?>">
 			<input type="hidden" name="announceurl" value="<?php echo $_POST['announceurl'];?>">
 			<input type="hidden" name="indexpagelimitspecify" value="<?php echo $_POST['indexpagelimitspecify'];?>">
diff --git a/newtorrents.php b/newtorrents.php
index 7d10fb7..55af3b4 100644
--- a/newtorrents.php
+++ b/newtorrents.php
@@ -232,11 +232,11 @@ function endOutput()
 	?>
 	<p align="right"><a href="./docs/help.html"><img src="images/help.png" border="0" class="icon" alt="Help" title="Help" /></a><a href="./docs/help.html">Help</a></p>
 	<div class="center">
 	<h1>Add Torrent to Tracker Database</h1>
 	<h3>Tracker URL: <?php echo $tracker_url;?></h3>
-	<form enctype="multipart/form-data" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
+	<form enctype="multipart/form-data" method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>">
 	<table>
 	<tr>
 		<td class="right">Torrent file:</td>
 		<td class="left"><?php
 		if (function_exists("sha1"))
diff --git a/statistics.php b/statistics.php
index b73b8ea..8fc76ac 100644
--- a/statistics.php
+++ b/statistics.php
@@ -21,11 +21,11 @@ if (!$_SESSION['admin_logged_in'])
 	<link rel="stylesheet" href="./css/style.css" type="text/css" />
 </head>
 <body>
 <h1>Tracker User Statistics</h1>
 
-<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="POST">
+<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="POST">
 Filename Search:<input type="text" name="filename_search" size="40"<?php if (isset($_POST["filename_search"]))echo " value=\"" . $_POST["filename_search"] . "\"";?>>
 <input type="submit" value="Search">
 </form>
 <br>
 
@@ -46,11 +46,11 @@ if (isset($_POST["filename_search"]) && $_POST["filename_search"] != "")
 	echo "<h2 align=\"center\">Search Results:</h2>";
 	$query = "SELECT * FROM ".$prefix."summary LEFT JOIN ".$prefix."namemap ON ".$prefix."summary.info_hash = ".$prefix."namemap.info_hash WHERE ".$prefix."namemap.filename REGEXP \"$_POST[filename_search]\" ORDER BY ".$prefix."namemap.filename";
 }
 else //display everything
 {
-	$scriptname = $_SERVER["PHP_SELF"] . "?";
+	$scriptname = htmlentities($_SERVER['PHP_SELF']) . "?";
 	
 	if (!isset($_GET["activeonly"])) 
 		echo "<a href=\"$scriptname" . "activeonly=yes\">Show only torrents with seeders/leechers</a>\n";
 	else
 	{

Vulnerable code: <form enctype="multipart/form-data" method="POST" action="<?php echo $_SERVER["PHP_SELF"]; ?>">
		<form enctype="multipart/form-data" action="<?php echo $_SERVER["PHP_SELF"];?>" method="post">
	<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="post">
	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post"> 
	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post">
	<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post"> 
<form action="<?php echo $_SERVER["PHP_SELF"];?>"  method="POST">
		echo "<tr><td><a href=\"" . $PHP_SELF . "?filename=" . rawurlencode($data[0]) . "\">" . $data[0] . "</a></td></tr>\n";
	<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="POST">
	<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="POST">
		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
		<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
			<form method="post" action="<?php echo $_SERVER["PHP_SELF"];?>">
	<form enctype="multipart/form-data" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
<form action="<?php echo $_SERVER["PHP_SELF"];?>" method="POST">
	$scriptname = $_SERVER["PHP_SELF"] . "?";
Fixed code: <form enctype="multipart/form-data" method="POST" action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>">
		<form enctype="multipart/form-data" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post"> 
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post">
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="post"> 
<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>"  method="POST">
		echo "<tr><td><a href=\"" . htmlentities($_SERVER['PHP_SELF']) . "?filename=" . rawurlencode($data[0]) . "\">" . $data[0] . "</a></td></tr>\n";
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="POST">
	<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="POST">
		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
		<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
			<form method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>">
	<form enctype="multipart/form-data" method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>">
<form action="<?php echo htmlentities($_SERVER['PHP_SELF']);?>" method="POST">
	$scriptname = htmlentities($_SERVER['PHP_SELF']) . "?";