CVE-2024-27516: Insufficient Information (NVD-CWE-noinfo)
value: Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obtain sensitive information via the search parameter in lhc_web/modules/lhfaq/faqweight.php.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-29T01:44Z
Repository: https://github.com/LiveHelperChat/livehelperchat
Language: PHP
Files changed: lhc_web/design/defaulttheme/tpl/lhchat/onlineusers/section_online_users.tpl.php, lhc_web/modules/lhfaq/faqwidget.php
Commit date: 2024-02-20 05:55:58 -0500
Commit message: fix #2054

In next two weeks svelte version will be released. So all these never ending angular issues will be over for the most of the part.

Diff: diff --git a/lhc_web/design/defaulttheme/tpl/lhchat/onlineusers/section_online_users.tpl.php b/lhc_web/design/defaulttheme/tpl/lhchat/onlineusers/section_online_users.tpl.php
index bbf939381..ce1cb4b6e 100644
--- a/lhc_web/design/defaulttheme/tpl/lhchat/onlineusers/section_online_users.tpl.php
+++ b/lhc_web/design/defaulttheme/tpl/lhchat/onlineusers/section_online_users.tpl.php
@@ -18,11 +18,11 @@
             </li>
 	    </div>
 
 	</div>
 	<div class="col-2 pe-0">
-		<input class="form-control form-control-sm" <?php if (isset($_GET['search'])) :?>ng-init='query=<?php echo json_encode(strip_tags($_GET['search']),JSON_HEX_APOS);?>'<?php endif?> ng-model="query" type="text" value="" placeholder="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/lists/search_panel','Type to search')?>">
+		<input class="form-control form-control-sm" <?php if (isset($_GET['search'])) :?>ng-init='query=<?php echo json_encode(str_replace(array('}}','{{'),'',strip_tags($_GET['search'])),JSON_HEX_APOS);?>'<?php endif?> ng-model="query" type="text" value="" placeholder="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/lists/search_panel','Type to search')?>">
 	</div>
 	<div class="col-1 pe-0">
 		<select class="form-control form-control-sm" ng-model="groupByField" title="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Group list by');?>">
 		    	<option value="none"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','Group by');?></option>
 		    	<option value="user_country_name"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/onlineusers','User country');?></option>
diff --git a/lhc_web/modules/lhfaq/faqwidget.php b/lhc_web/modules/lhfaq/faqwidget.php
index 4bfbbeab6..f8aa43ced 100644
--- a/lhc_web/modules/lhfaq/faqwidget.php
+++ b/lhc_web/modules/lhfaq/faqwidget.php
@@ -135,11 +135,11 @@ if (isset($_GET['doSearch'])) {
         $q->expr->like('question', $q->bindValue('%' . $searchString . '%')
      ));
     $dynamic_url_append .= '/(search)/'.rawurlencode($searchString);
 }
 
-$tpl->set('keyword',$keywordSearch);
+$tpl->set('keyword', str_replace(array('}}','{{'),'',$keywordSearch));
 
 $q->where($whereConditions);
 
 
 $stmt = $q->prepare();

Vulnerable code: 		<input class="form-control form-control-sm" <?php if (isset($_GET['search'])) :?>ng-init='query=<?php echo json_encode(strip_tags($_GET['search']),JSON_HEX_APOS);?>'<?php endif?> ng-model="query" type="text" value="" placeholder="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/lists/search_panel','Type to search')?>">
$tpl->set('keyword',$keywordSearch);
Fixed code: 		<input class="form-control form-control-sm" <?php if (isset($_GET['search'])) :?>ng-init='query=<?php echo json_encode(str_replace(array('}}','{{'),'',strip_tags($_GET['search'])),JSON_HEX_APOS);?>'<?php endif?> ng-model="query" type="text" value="" placeholder="<?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('chat/lists/search_panel','Type to search')?>">
$tpl->set('keyword', str_replace(array('}}','{{'),'',$keywordSearch));