CVE-2017-20177: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in WangGuard Plugin 1.8.0 on WordPress. Affected by this issue is the function wangguard_users_info of the file wangguard-user-info.php of the component WGG User List Handler. The manipulation of the argument userIP leads to cross site scripting. The attack may be launched remotely. The patch is identified as 88414951e30773c8d2ec13b99642688284bf3189. It is recommended to apply a patch to fix this issue. VDB-220214 is the identifier assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-02-06T20:15Z
Repository: https://github.com/joseconti/WangGuard
Language: PHP
Files changed: wangguard-class-wp-users.php, wangguard-user-info.php
Commit date: 2017-01-18 13:41:38 +0100
Commit message: Fixed XSS Vulneraibility

When showing user info from WGG users list, user IP was passed through URL without sanitization. After this commit the user IP is no longer needed in the URL as the screen will get the IP from WGG tables instead.
Also $_GET['userID'] is now sanitized and casted to an integer to apply some more defensive programming, you know, just in case.

Diff: diff --git a/wangguard-class-wp-users.php b/wangguard-class-wp-users.php
index 64c749c..15ac02a 100644
--- a/wangguard-class-wp-users.php
+++ b/wangguard-class-wp-users.php
@@ -224,11 +224,11 @@ class WangGuard_Users_Table extends WP_List_Table {
 					if ( !is_multisite() ) {
 						$url = esc_url( admin_url( add_query_arg( array( 'page' => 'wangguard_users_info' ), 'admin.php' ) ) );
 					} else {
 						$url = esc_url( network_admin_url( add_query_arg( array( 'page' => 'wangguard_users_info' ), 'admin.php' ) ) );
 					}
-					$arrayUrl = array ('userID' => $user_id, 'userIP' => $row_data->user_ip, '?TB_iframe' => 'true', 'width' => '900', 'height' => '550' );
+					$arrayUrl = array ('userID' => $user_id, '?TB_iframe' => 'true', 'width' => '900', 'height' => '550' );
 					$final_user_info_url = esc_url( add_query_arg(  $arrayUrl , $url ));
 					$cell_contents = "<a class='thickbox' title='" . __( 'Info about','wangguard') . " {$row_data->first_name} {$row_data->last_name}' href='" . $final_user_info_url . "'><img class='alignnone size-full wp-image-2055' alt='Info about {$row_data->first_name} {$row_data->last_name}' src='" . plugins_url( 'img/info-wgg.png' , __FILE__ ) . "' width='15' height='15' /> " . __('User Info', 'wangguard' ) . "</a>";
 					break;
 				case 'username':
 					$avatar = get_avatar( $user_id, 32 );
diff --git a/wangguard-user-info.php b/wangguard-user-info.php
index 2236ace..893d460 100644
--- a/wangguard-user-info.php
+++ b/wangguard-user-info.php
@@ -5,13 +5,16 @@
 if ( !defined( 'ABSPATH' ) ) exit;
 function wangguard_users_info() {
 	global $wpdb,$wangguard_nonce, $wangguard_api_key, $blog_id;
 	if ( !current_user_can('level_10') )
 		die(__('Cheatin&#8217; uh?', 'wangguard'));
-		$userID = $_GET["userID"];
-		$userIP = $_GET["userIP"];
+		$userID = absint( $_GET["userID"] );
 		$user_info = get_userdata($userID);
+
+		$table = $wpdb->base_prefix . 'wangguarduserstatus';
+		$userIP = $wpdb->get_var( $wpdb->prepare( "SELECT user_ip FROM $table WHERE ID = %d", $userID ) );
+		$userIP = $userIP ? $userIP : '';
 	//$blogID = $user_info->primary_blog;
 	//if ( function_exists( is_multisite() ) ) {
 	//$blog_details = get_blog_details( array( 'blog_id' => $blogID ) );
 	//}
 ?>

Vulnerable code: 					$arrayUrl = array ('userID' => $user_id, 'userIP' => $row_data->user_ip, '?TB_iframe' => 'true', 'width' => '900', 'height' => '550' );
		$userID = $_GET["userID"];
		$userIP = $_GET["userIP"];
Fixed code: 					$arrayUrl = array ('userID' => $user_id, '?TB_iframe' => 'true', 'width' => '900', 'height' => '550' );
		$userID = absint( $_GET["userID"] );

		$table = $wpdb->base_prefix . 'wangguarduserstatus';
		$userIP = $wpdb->get_var( $wpdb->prepare( "SELECT user_ip FROM $table WHERE ID = %d", $userID ) );
		$userIP = $userIP ? $userIP : '';