CVE-2014-4743: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in (1) search_ajax.tpl and (2) search_ajax_small.tpl in templates/default/tpl/module_search/ in the Search module (module_search) in Kajona before 4.5 allow remote attackers to inject arbitrary web script or HTML via the search parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-07-09T14:55Z
Repository: https://github.com/kajona/kajonacms
Language: Other
Files changed: module_search/templates/default/tpl/module_search/search_ajax.tpl, module_search/templates/default/tpl/module_search/search_ajax_small.tpl
Commit date: 2014-06-08 21:53:09 +0200
Commit message: BUG / SECURITY: module_search | portal-js -> fixed a possible xss injection, the search param is now included htmlencoded an no longer as plaintext

Diff: diff --git a/module_search/templates/default/tpl/module_search/search_ajax.tpl b/module_search/templates/default/tpl/module_search/search_ajax.tpl
index 37decec25..13c4ee75e 100755
--- a/module_search/templates/default/tpl/module_search/search_ajax.tpl
+++ b/module_search/templates/default/tpl/module_search/search_ajax.tpl
@@ -34,12 +34,12 @@
                 KAJONA.portal.search.strLastQuery = strCurrentQuery;
                 $('#searchResult').html("<div style='height: 50px; background-image: url(_webpath_/templates/default/pics/default/loading.gif); background-repeat: no-repeat; background-position: center;'></div>");
 
                 $.post(post_target, post_data, function(data, textStatus) {
                     $('#searchResult').html("<ul></ul>");
-                    $("#spanSearchterm").html($(data).find("searchterm").text());
-                    $("#spanSearchamount").html($(data).find("nrofresults").text());
+                    $("#spanSearchterm").html($(data).find("searchterm").html());
+                    $("#spanSearchamount").html($(data).find("nrofresults").html());
                     $('#resultSetHeader').css("display", "block");
 
                     $(data).find("item").each(function() {
                         var objNode = $("<li></li>");
                         objNode.append("<a href='"+$(this).find("pagelink").find("a").attr("href")+"'>"+$(this).find("pagelink").find("a").text()+"</a>" );
diff --git a/module_search/templates/default/tpl/module_search/search_ajax_small.tpl b/module_search/templates/default/tpl/module_search/search_ajax_small.tpl
index ea2966bf8..4070793cf 100755
--- a/module_search/templates/default/tpl/module_search/search_ajax_small.tpl
+++ b/module_search/templates/default/tpl/module_search/search_ajax_small.tpl
@@ -37,12 +37,12 @@
                 $('#searchResultSmall').html("<div style='height: 50px; width: 50px; background-image: url(_webpath_/templates/default/pics/default/loading.gif); background-repeat: no-repeat; background-position: center;'></div>");
 
                 $.post(post_target, post_data, function(data, textStatus) {
 
 
-                    $("#spanSearchtermSmall").html($(data).find("searchterm").text());
-                    $("#spanSearchamountSmall").html($(data).find("nrofresults").text());
+                    $("#spanSearchtermSmall").html($(data).find("searchterm").html());
+                    $("#spanSearchamountSmall").html($(data).find("nrofresults").html());
 
                     $('#searchResultSmall').html($("#resultSetHeaderSmall").html());
                     $('#searchResultSmall').append($("<ul></ul>"));
 
                     $(data).find("item").each(function() {

Vulnerable code:                     $("#spanSearchterm").html($(data).find("searchterm").text());
                    $("#spanSearchamount").html($(data).find("nrofresults").text());
                    $("#spanSearchtermSmall").html($(data).find("searchterm").text());
                    $("#spanSearchamountSmall").html($(data).find("nrofresults").text());
Fixed code:                     $("#spanSearchterm").html($(data).find("searchterm").html());
                    $("#spanSearchamount").html($(data).find("nrofresults").html());
                    $("#spanSearchtermSmall").html($(data).find("searchterm").html());
                    $("#spanSearchamountSmall").html($(data).find("nrofresults").html());