CVE-2010-10004: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability was found in Information Cards Module on simpleSAMLphp and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0 is able to address this issue. The identifier of the patch is f6bfea49ae16dc6e179df8306d39c3694f1ef186. It is recommended to upgrade the affected component. The identifier VDB-217661 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-09T08:15Z
Repository: https://github.com/simplesamlphp/simplesamlphp-module-infocard
Language: PHP
Files changed: templates/temp-getcardform.php, templates/temp-login.php
Commit date: 2010-07-29 10:41:03 +0000
Commit message: InfoCard: Fix cross-site scripting.

If the InfoCard module is enabled, it can be used to perform cross-site
scripting attacks on the site where it is installed.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2435 44740490-163a-0410-bde0-09ae8108e29a

Diff: diff --git a/templates/temp-getcardform.php b/templates/temp-getcardform.php
index ae00910..fecc40f 100644
--- a/templates/temp-getcardform.php
+++ b/templates/temp-getcardform.php
@@ -20,11 +20,11 @@
 	<?php
 		if (strcmp($this->data['CardGenerator'],'')>0) {
 		
 			if(strcmp($this->data['form'],"validate")==0){
 				echo '<h2>'.$this->t('getcardform_title').'</h2>';
-				echo '<form action = ?AuthState='.$this->data['stateparams']['AuthState']." method='post'>";
+				echo '<form action = ?AuthState='.htmlspecialchars($this->data['stateparams']['AuthState'])." method='post'>";
 					echo '<table border="0">';
 					echo "<tr><td>".$this->t('form_username').": </td><td><input type='text' name='username' value='usuario' /></td></tr>";
 					echo "<tr><td>".$this->t('form_password').": </td><td><input type='password' name='password' value='clave' /></td></tr>";
 					echo "<tr><td></td><td><input type='submit' name='get_button' value='".$this->t('get_button')."' /></td></tr>";
 					echo "<input type='hidden' name='form' value='".$this->data['form']."'/>";
@@ -32,28 +32,28 @@
 				echo '</form>';
 				
 			} else if(strcmp($this->data['form'],"selfIssued")==0){ //ASK FOR A SELF-ISSUED CARD
 				echo '<h2>'.$this->t('getcardform_self_title').'</h2>';
 				echo '<p>'.$this->t('getcardform_self_text').'</p>';
-				echo	'<form name="ctl00" id="ctl00" method="post" action="?AuthState='.$this->data['stateparams']['AuthState'].'">';
+				echo	'<form name="ctl00" id="ctl00" method="post" action="?AuthState='.htmlspecialchars($this->data['stateparams']['AuthState']).'">';
 					echo	'<OBJECT type="application/x-informationCard" name="xmlToken">';
 						echo '<PARAM Name="issuer" Value="http://schemas.xmlsoap.org/ws/2005/05/identity/issuer/self" />';
 						if ($this->data['InfoCard']['issuerPolicy']!='') echo '<PARAM Name="issuerPolicy" Value="'.$this->data['InfoCard']['issuerPolicy']."\">\n";
 						if ($this->data['InfoCard']['tokenType']!='') echo '<PARAM Name="tokenType" Value="'.$this->data['InfoCard']['tokenType']."\">\n";
 						if ($this->data['InfoCard']['privacyURL']!='') echo '<PARAM Name="privacyUrl" Value="'.$this->data['InfoCard']['privacyURL']."\">\n";
 						if ($this->data['InfoCard']['privacyVersion']!='')echo '<PARAM Name="privacyVersion" Value="'.$this->data['InfoCard']['privacyVersion']."\">\n";
 						echo '<PARAM Name="requiredClaims" Value="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier">';
 					echo '</OBJECT>';
-					echo "<input type='hidden' name='username' value='".$this->data['username']."'/>";
-					echo "<input type='hidden' name='password' value='".$this->data['password']."'/>";
+					echo "<input type='hidden' name='username' value='".htmlspecialchars($this->data['username'])."'/>";
+					echo "<input type='hidden' name='password' value='".htmlspecialchars($this->data['password'])."'/>";
 					echo "<input type='hidden' name='form' value='".$this->data['form']."'/>";
 					echo "<input type='image' src='resources/infocard_self_114x80.png' style='cursor:pointer' />";
 				echo '</form>';
 			} else {
 				echo '<h2>'.$this->t('getcardform_finished_title').'</h2>';
 				echo '<p>'.$this->t('getcardform_finished_text').'</p>';
-				echo '<p> <a href="login-infocard.php?AuthState='.$this->data['stateparams']['AuthState'].'">LOGIN</a></p>';
+				echo '<p> <a href="login-infocard.php?AuthState='.htmlspecialchars($this->data['stateparams']['AuthState']).'">LOGIN</a></p>';
 			}
 		}
   ?>
 	 
 <!-- 	 HELP SECTION -->
diff --git a/templates/temp-login.php b/templates/temp-login.php
index 8417aa5..3469863 100644
--- a/templates/temp-login.php
+++ b/templates/temp-login.php
@@ -17,11 +17,11 @@
 
 	<h2 style="break: both"><?php echo $this->t('user_IC_header'); ?></h2>
 	
 	<p><?php echo $this->t('user_IC_text'); ?></p>
 	
-	<form name="ctl00" id="ctl00" method="post" action="?AuthState=<?php echo $this->data['stateparams']['AuthState']?>">
+	<form name="ctl00" id="ctl00" method="post" action="?AuthState=<?php echo htmlspecialchars($this->data['stateparams']['AuthState'])?>">
 
 <!--		<ic:informationCard xmlns:ic="<?php echo $this->data['InfoCard']['schema'] ?>" name="xmlToken" 
 			issuer="<?php echo $this->data['InfoCard']['issuer']; ?>"
 			<?php 
 				if ($this->data['InfoCard']['issuerPolicy']!='') echo 'issuerPolicy="'.$this->data['InfoCard']['issuerPolicy'].'"';

Vulnerable code: 				echo '<form action = ?AuthState='.$this->data['stateparams']['AuthState']." method='post'>";
				echo	'<form name="ctl00" id="ctl00" method="post" action="?AuthState='.$this->data['stateparams']['AuthState'].'">';
					echo "<input type='hidden' name='username' value='".$this->data['username']."'/>";
					echo "<input type='hidden' name='password' value='".$this->data['password']."'/>";
				echo '<p> <a href="login-infocard.php?AuthState='.$this->data['stateparams']['AuthState'].'">LOGIN</a></p>';
	<form name="ctl00" id="ctl00" method="post" action="?AuthState=<?php echo $this->data['stateparams']['AuthState']?>">
Fixed code: 				echo '<form action = ?AuthState='.htmlspecialchars($this->data['stateparams']['AuthState'])." method='post'>";
				echo	'<form name="ctl00" id="ctl00" method="post" action="?AuthState='.htmlspecialchars($this->data['stateparams']['AuthState']).'">';
					echo "<input type='hidden' name='username' value='".htmlspecialchars($this->data['username'])."'/>";
					echo "<input type='hidden' name='password' value='".htmlspecialchars($this->data['password'])."'/>";
				echo '<p> <a href="login-infocard.php?AuthState='.htmlspecialchars($this->data['stateparams']['AuthState']).'">LOGIN</a></p>';
	<form name="ctl00" id="ctl00" method="post" action="?AuthState=<?php echo htmlspecialchars($this->data['stateparams']['AuthState'])?>">