CVE-2023-3074: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository tsolucio/corebos prior to 8.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-06-02T18:15Z
Repository: https://github.com/tsolucio/corebos
Language: PHP
Files changed: modules/Users/DetailViewAjax.php, modules/Users/Save.php
Commit date: 2023-06-02 18:46:30 +0200
Commit message: sec(Users) sanitize email and name

Diff: diff --git a/modules/Users/DetailViewAjax.php b/modules/Users/DetailViewAjax.php
index f8de535fbb4..a041d0ffdd8 100644
--- a/modules/Users/DetailViewAjax.php
+++ b/modules/Users/DetailViewAjax.php
@@ -56,10 +56,15 @@ if ($ajaxaction == 'DETAILVIEW') {
 		$homeStuffOrder = $userObj->getHomeStuffOrder($userid);
 		foreach ($homeStuffOrder as $widget => $visible) {
 			$_REQUEST[$widget] = $visible;
 		}
 		$_REQUEST['tagcloudview'] = $homeStuffOrder['Tag Cloud'];
+		$userObj->column_fields['first_name'] = vtlib_purify($userObj->column_fields['first_name']);
+		$userObj->column_fields['last_name'] = vtlib_purify($userObj->column_fields['last_name']);
+		$userObj->column_fields['email1'] = filter_var($userObj->column_fields['email1'], FILTER_SANITIZE_EMAIL);
+		$userObj->column_fields['email2'] = filter_var($userObj->column_fields['email2'], FILTER_SANITIZE_EMAIL);
+		$userObj->column_fields['secondaryemail'] = filter_var($userObj->column_fields['secondaryemail'], FILTER_SANITIZE_EMAIL);
 		$userObj->save('Users');
 		if ($userObj->id != '') {
 			echo ':#:SUCCESS:#:';
 			$_REQUEST['action'] = $currentModule;
 			decide_to_html();
diff --git a/modules/Users/Save.php b/modules/Users/Save.php
index 19ef890c758..323c7fb5de3 100644
--- a/modules/Users/Save.php
+++ b/modules/Users/Save.php
@@ -122,10 +122,12 @@ if (empty($_REQUEST['changepassword']) || $_REQUEST['changepassword'] != 'true')
 	}
 	if (isset($_SESSION['internal_mailer']) && $_SESSION['internal_mailer'] != $focus->column_fields['internal_mailer']) {
 		coreBOS_Session::set('internal_mailer', $focus->column_fields['internal_mailer']);
 	}
 	setObjectValuesFromRequest($focus);
+	$focus->column_fields['first_name'] = vtlib_purify($focus->column_fields['first_name']);
+	$focus->column_fields['last_name'] = vtlib_purify($focus->column_fields['last_name']);
 	$focus->column_fields['email1'] = filter_var($focus->column_fields['email1'], FILTER_SANITIZE_EMAIL);
 	$focus->column_fields['email2'] = filter_var($focus->column_fields['email2'], FILTER_SANITIZE_EMAIL);
 	$focus->column_fields['secondaryemail'] = filter_var($focus->column_fields['secondaryemail'], FILTER_SANITIZE_EMAIL);
 
 	if (empty($focus->column_fields['roleid']) && !empty($_POST['user_role'])) {

Fixed code: 		$userObj->column_fields['first_name'] = vtlib_purify($userObj->column_fields['first_name']);
		$userObj->column_fields['last_name'] = vtlib_purify($userObj->column_fields['last_name']);
		$userObj->column_fields['email1'] = filter_var($userObj->column_fields['email1'], FILTER_SANITIZE_EMAIL);
		$userObj->column_fields['email2'] = filter_var($userObj->column_fields['email2'], FILTER_SANITIZE_EMAIL);
		$userObj->column_fields['secondaryemail'] = filter_var($userObj->column_fields['secondaryemail'], FILTER_SANITIZE_EMAIL);
	$focus->column_fields['first_name'] = vtlib_purify($focus->column_fields['first_name']);
	$focus->column_fields['last_name'] = vtlib_purify($focus->column_fields['last_name']);