CVE-2023-5244: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 2.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-09-28T01:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: userfiles/modules/microweber/toolbar/editor_tools/rte_image_editor/index.php
Commit date: 2023-06-29 11:02:39 +0300
Commit message: update

Diff: diff --git a/userfiles/modules/microweber/toolbar/editor_tools/rte_image_editor/index.php b/userfiles/modules/microweber/toolbar/editor_tools/rte_image_editor/index.php
index a2c9c2dfd9b..dbc4f309f9d 100644
--- a/userfiles/modules/microweber/toolbar/editor_tools/rte_image_editor/index.php
+++ b/userfiles/modules/microweber/toolbar/editor_tools/rte_image_editor/index.php
@@ -11,23 +11,22 @@
 
 <?php
 
 if (array_key_exists('types', $_GET)) {
     $types = explode(',', $_GET['types']);
-
+    $types = xss_clean($types);
 } else {
     $types = array('files', 'images', 'videos');
 }
 
 if (array_key_exists('title', $_GET)) {
     $title = $_GET['title'];
-
+    $title = xss_clean($title);
 } else {
     $title = __('Media');
 }
 
-
 ?>
 
 <div id="filepick"></div>
 
 <script>
@@ -38,17 +37,16 @@ if (array_key_exists('title', $_GET)) {
     UpdateImage = function (url) {
         if (mw.parent().image.currentResizing) {
             if (mw.parent().image.currentResizing[0].nodeName === 'IMG') {
                 mw.parent().image.currentResizing.attr("src", url);
                 mw.parent().image.currentResizing.css('height', 'auto');
-            }
-            else {
+            } else {
                 mw.parent().image.currentResizing.css("backgroundImage", 'url(' + mw.files.safeFilename(url) + ')');
                 mw.top().wysiwyg.bgQuotesFix(mw.parent().image.currentResizing[0])
             }
         }
-        if(window.thismodal) {
+        if (window.thismodal) {
             thismodal.result(url);
         }
     };
 
     afterMediaIsInserted = function (url, todo, eventType) {
@@ -70,11 +68,11 @@ if (array_key_exists('title', $_GET)) {
         }
         if (!todo) {
             if (hash !== '') {
                 if (hash === 'editimage') {
                     UpdateImage(url);
-                    if(mw.parent().image.currentResizing){
+                    if (mw.parent().image.currentResizing) {
                         mw.parent().wysiwyg.change(mw.parent().image.currentResizing[0])
                         mw.parent().image.resize.resizerSet(mw.parent().image.currentResizing[0]);
                         mw.parent().trigger('imageSrcChanged', [mw.parent().image.currentResizing[0], url])
                     }
                 } else if (hash === 'set_bg_image') {
@@ -83,11 +81,11 @@ if (array_key_exists('title', $_GET)) {
                     mw.parent().askusertostay = true;
                 } else {
                     if (typeof parent[hash] === 'function') {
                         parent[hash](url, eventType);
                     } else {
-                        if(mw.parent().iframecallbacks['insert_image']) {
+                        if (mw.parent().iframecallbacks['insert_image']) {
                             mw.parent().iframecallbacks['insert_image'](url, eventType);
                         }
 
                     }
                 }
@@ -119,11 +117,11 @@ if (array_key_exists('title', $_GET)) {
             if (typeof mw.parent().iframecallbacks[hash] === 'function') {
                 if (hash === 'editimage') {
 
 
                     mw.parent().iframecallbacks[hash](pval);
-                    if(mw.parent().image.currentResizing && mw.parent().image.currentResizing){
+                    if (mw.parent().image.currentResizing && mw.parent().image.currentResizing) {
                         mw.parent().image.resize.resizerSet(mw.parent().image.currentResizing[0]);
 
                     }
 
                 } else {
@@ -133,15 +131,15 @@ if (array_key_exists('title', $_GET)) {
 
             } else if (typeof parent[hash] === 'function') {
 
                 parent[hash](GlobalEmbed)
             }
-            if(mw.parent().image.currentResizing && mw.parent().image.currentResizing[0]) {
+            if (mw.parent().image.currentResizing && mw.parent().image.currentResizing[0]) {
                 mw.parent().trigger('imageSrcChanged', [mw.parent().image.currentResizing[0], this]);
             }
 
-            if(window.thismodal) {
+            if (window.thismodal) {
                 thismodal.result(pval)
             }
 
             mw.parent().dialog.remove('mw_rte_image');
 
@@ -161,38 +159,35 @@ if (array_key_exists('title', $_GET)) {
         }
 
         mw.require('filepicker.js');
 
         var picker = new mw.filePicker({
-            element:'#filepick',
+            element: '#filepick',
             nav: 'tabs',
             footer: true,
             boxed: false,
             dropDownTargetMode: 'dialog',
             label: null
         });
 
 
-
         $(picker).on('Result', function (e, res) {
             var filetypes = '<?php print join(",", $types);; ?>';
             var url = res.src ? res.src : res;
             if (filetypes.indexOf('images') !== -1) {
                 afterMediaIsInserted(url, '', "FileUploaded");
-            }
-            else if (filetypes === 'videos' || filetypes === 'media') {
+            } else if (filetypes === 'videos' || filetypes === 'media') {
                 afterMediaIsInserted(url, 'video', "FileUploaded");
-            }
-            else if (filetypes === 'files') {
+            } else if (filetypes === 'files') {
                 if (item.src.contains("base64")) {
                     afterMediaIsInserted(url, '', "FileUploaded");
                 } else {
                     afterMediaIsInserted(url, 'files', "FileUploaded");
                 }
 
             }
-            if(window.thismodal) {
+            if (window.thismodal) {
                 thismodal.result(url);
                 thismodal.remove()
             }
         })
 
@@ -217,29 +212,25 @@ if (array_key_exists('title', $_GET)) {
                 ProgressPercent.html(file.percent + '%');
 
                 ProgressInfo.html(file.name);
 
 
-
-
             });
             $(frame).on("FileUploaded", function (frame, item) {
                 if (filetypes.indexOf('images') !== -1) {
                     afterMediaIsInserted(item.src, '', "FileUploaded");
-                }
-                else if (filetypes === 'videos' || filetypes === 'media') {
+                } else if (filetypes === 'videos' || filetypes === 'media') {
                     afterMediaIsInserted(item.src, 'video', "FileUploaded");
-                }
-                else if (filetypes === 'files') {
+                } else if (filetypes === 'files') {
                     if (item.src.contains("base64")) {
                         afterMediaIsInserted(item.src, '', "FileUploaded");
                     } else {
                         afterMediaIsInserted(item.src, 'files', "FileUploaded");
                     }
 
                 }
-                if(window.thismodal) {
+                if (window.thismodal) {
                     thismodal.result(item.src)
                 }
 
             });
 
@@ -257,11 +248,10 @@ if (array_key_exists('title', $_GET)) {
                 ProgressPercent.html('');
                 ProgressInfo.html(ProgressErrorHTML(file.name));
             });
 
 
-
         });
 
 
         var urlSearcher = mw.$("#media_search_field");
         var submit = mw.$('#btn_insert');
@@ -288,11 +278,11 @@ if (array_key_exists('title', $_GET)) {
             } else {
                 setTimeout(function () {
                     var val = urlSearcher.val();
                     if (hash === 'fileWindow') {
 
-                        if(window.thismodal) {
+                        if (window.thismodal) {
                             thismodal.result(val)
                         }
                         $('body').trigger('change', [val]);
                         return false;
                     }
@@ -307,11 +297,11 @@ if (array_key_exists('title', $_GET)) {
                             }
                         } else if (typeof parent[hash] === 'function') {
                             parent[hash](GlobalEmbed);
 
                         }
-                        if(window.thismodal) {
+                        if (window.thismodal) {
                             thismodal.result(GlobalEmbed)
                         }
                         mw.parent().dialog.remove('mw_rte_image');
                     }
                 }, 500);
@@ -342,14 +332,14 @@ if (array_key_exists('title', $_GET)) {
                 } else if (typeof parent[hash] === 'function') {
                     parent[hash](val)
                 }
 
             }
-            if(window.thismodal) {
+            if (window.thismodal) {
                 thismodal.result(val)
             }
-            if(mw.parent().image.currentResizing) {
+            if (mw.parent().image.currentResizing) {
                 mw.parent().trigger('imageSrcChanged', [mw.parent().image.currentResizing[0], val]);
 
             }
 
             mw.parent().dialog.remove('mw_rte_image');
@@ -368,11 +358,11 @@ if (array_key_exists('title', $_GET)) {
                 beforeRemove: function () {
                     $(rep).replaceWith(active)
                 }
             })
 
-            if(mode === 'dialog' && index > 0) {
+            if (mode === 'dialog' && index > 0) {
 
             } else {
                 $('.tab').hide()//.eq(index).show()
             }
 
@@ -385,19 +375,19 @@ if (array_key_exists('title', $_GET)) {
 
                 if (!window.fileBrowserLoaded) {
                     window.fileBrowserLoaded = true;
                     mw.top().load_module('files/admin', '#file_module_live_edit_adm', function () {
 
-                    }, {'filetype':'images'});
+                    }, {'filetype': 'images'});
                 }
 
             } else {
-             }
-            if(window.thismodal){
-                if(this.selectedIndex === ($(selector).length - 1)){
+            }
+            if (window.thismodal) {
+                if (this.selectedIndex === ($(selector).length - 1)) {
                     thismodal.resize(800)
-                } else if(this.selectedIndex === 2){
+                } else if (this.selectedIndex === 2) {
                     thismodal.resize(600)
                 } else {
                     thismodal.resize(460)
                 }
             }
@@ -464,15 +454,15 @@ if (array_key_exists('title', $_GET)) {
     }
 
 </script>
 
 
-<style >
+<style>
 
-/*    body, html {
-        overflow: hidden;
-    }*/
+    /*    body, html {
+            overflow: hidden;
+        }*/
 
     .mw-upload-filetypes {
         list-style: none;
         overflow: hidden;
         position: relative;
@@ -537,14 +527,16 @@ if (array_key_exists('title', $_GET)) {
     #media_search_field {
         float: left;
         width: 275px;
         margin-inline-end: 15px;
     }
-    .image-tabs-header > div h6{
+
+    .image-tabs-header > div h6 {
         margin-bottom: 0;
     }
-    .image-tabs-header{
+
+    .image-tabs-header {
         display: flex;
         justify-content: space-between;
         align-content: center;
         align-items: center;
         padding-bottom: 10px;

Vulnerable code: 


            }
            else {
        if(window.thismodal) {
                    if(mw.parent().image.currentResizing){
                        if(mw.parent().iframecallbacks['insert_image']) {
                    if(mw.parent().image.currentResizing && mw.parent().image.currentResizing){
            if(mw.parent().image.currentResizing && mw.parent().image.currentResizing[0]) {
            if(window.thismodal) {
            element:'#filepick',

            }
            else if (filetypes === 'videos' || filetypes === 'media') {
            }
            else if (filetypes === 'files') {
            if(window.thismodal) {


                }
                else if (filetypes === 'videos' || filetypes === 'media') {
                }
                else if (filetypes === 'files') {
                if(window.thismodal) {

                        if(window.thismodal) {
                        if(window.thismodal) {
            if(window.thismodal) {
            if(mw.parent().image.currentResizing) {
            if(mode === 'dialog' && index > 0) {
                    }, {'filetype':'images'});
             }
            if(window.thismodal){
                if(this.selectedIndex === ($(selector).length - 1)){
                } else if(this.selectedIndex === 2){
<style >
/*    body, html {
        overflow: hidden;
    }*/
    .image-tabs-header > div h6{
    .image-tabs-header{
Fixed code:     $types = xss_clean($types);
    $title = xss_clean($title);
            } else {
        if (window.thismodal) {
                    if (mw.parent().image.currentResizing) {
                        if (mw.parent().iframecallbacks['insert_image']) {
                    if (mw.parent().image.currentResizing && mw.parent().image.currentResizing) {
            if (mw.parent().image.currentResizing && mw.parent().image.currentResizing[0]) {
            if (window.thismodal) {
            element: '#filepick',
            } else if (filetypes === 'videos' || filetypes === 'media') {
            } else if (filetypes === 'files') {
            if (window.thismodal) {
                } else if (filetypes === 'videos' || filetypes === 'media') {
                } else if (filetypes === 'files') {
                if (window.thismodal) {
                        if (window.thismodal) {
                        if (window.thismodal) {
            if (window.thismodal) {
            if (mw.parent().image.currentResizing) {
            if (mode === 'dialog' && index > 0) {
                    }, {'filetype': 'images'});
            }
            if (window.thismodal) {
                if (this.selectedIndex === ($(selector).length - 1)) {
                } else if (this.selectedIndex === 2) {
<style>
    /*    body, html {
            overflow: hidden;
        }*/

    .image-tabs-header > div h6 {

    .image-tabs-header {