CVE-2021-4309: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in 01-Scripts 01ACP. This issue affects some unknown processing. The manipulation of the argument $_SERVER['SCRIPT_NAME'] leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is a16eb7da46ed22bc61067c212635394f2571d3c4. It is recommended to apply a patch to fix this issue. The identifier VDB-217649 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-08T17:15Z
Repository: https://github.com/01-Scripts/01ACP
Language: PHP
Files changed: 01acp/_dev.php, 01acp/_loader.php, 01acp/acp.php, 01acp/comments.php, 01acp/filemanager.php, 01acp/index.php, 01acp/module.php, 01acp/rights.php, 01acp/settings.php, 01acp/system/uploader.php, 01acp/update.php, 01acp/users.php
Commit date: 2021-09-15 15:54:46 +0200
Commit message: Hotfix: XSS-Vulnerability $_SERVER['PHP_SELF']
https://seancoates.com/blogs/xss-woes

Diff: diff --git a/01acp/_dev.php b/01acp/_dev.php
index b245b25..2019303 100644
--- a/01acp/_dev.php
+++ b/01acp/_dev.php
@@ -8,11 +8,11 @@
 	Dateiinfo:	Übersicht über zentral zur Verfügung stehende Arrays
 */
 
 $menuecat = "01acp_start";
 $sitetitle = "Dev-Übersicht";
-$filename = $_SERVER['PHP_SELF'];
+$filename = $_SERVER['SCRIPT_NAME'];
 
 // Config-Dateien
 include("system/main.php");
 include("system/head.php");
 
diff --git a/01acp/_loader.php b/01acp/_loader.php
index f0b7061..e2228fe 100644
--- a/01acp/_loader.php
+++ b/01acp/_loader.php
@@ -13,11 +13,11 @@ include("system/main.php");
 
 if(!isset($_REQUEST['loadpage'])) $_REQUEST['loadpage'] = "";
 
 $menuecat = $modul;
 $sitetitle = $module[$modul]['instname'];
-$filename = $_SERVER['PHP_SELF']."?modul=".$modul."&amp;loadpage=".$_REQUEST['loadpage'];
+$filename = $_SERVER['SCRIPT_NAME']."?modul=".$modul."&amp;loadpage=".$_REQUEST['loadpage'];
 
 include("system/head.php");
 
 if(isset($_GET['modul']) && $_GET['modul'] == "01acp")
 	echo "<script>redirect(\"acp.php\");</script>";
diff --git a/01acp/acp.php b/01acp/acp.php
index 3069d24..9230ff5 100644
--- a/01acp/acp.php
+++ b/01acp/acp.php
@@ -10,11 +10,11 @@
 */
 
 $menuecat = "01acp_start";
 $sitetitle = "Startseite";
 $mootools_use = array("moo_core","moo_more","moo_slideh","moo_request");
-$filename = $_SERVER['PHP_SELF'];
+$filename = $_SERVER['SCRIPT_NAME'];
 
 
 // Config-Dateien
 include("system/main.php");
 include("system/head.php");
diff --git a/01acp/comments.php b/01acp/comments.php
index 995d6f5..370c9e3 100644
--- a/01acp/comments.php
+++ b/01acp/comments.php
@@ -15,11 +15,11 @@ $mootools_use = array("moo_core","moo_more","moo_slideh","moo_request");
 
 // Config-Dateien
 include("system/main.php");
 include("system/head.php");
 
-$filename = $_SERVER['PHP_SELF']."?modul=".$modul."";
+$filename = $_SERVER['SCRIPT_NAME']."?modul=".$modul."";
 
 // Sicherheitsabfrage: Login
 if(isset($userdata['id']) && $userdata['id'] > 0 && $userdata['editcomments'] == 1){
 
 echo "<h1>Kommentare verwalten</h1>";
@@ -139,11 +139,11 @@ if($modul != "01acp"){
 		echo echopages($csites,"80%","commentsites","modul=".$modul."");
 		}// Ende: Auflistung der Kommentare zu einem bestimmten Post
 	}
 else{
 	echo "<div class=\"meldung_hinweis\"><p><b>Bitte w&auml;hlen Sie ein Modul</b></p>".
-		create_ModulForm($_SERVER['PHP_SELF']."?","input",TRUE)."</div>";
+		create_ModulForm($_SERVER['SCRIPT_NAME']."?","input",TRUE)."</div>";
 	}
 
 
 }else $flag_loginerror = true;
 include("system/foot.php");
diff --git a/01acp/filemanager.php b/01acp/filemanager.php
index ca4d056..2e79c4c 100644
--- a/01acp/filemanager.php
+++ b/01acp/filemanager.php
@@ -9,11 +9,11 @@
 	#fv.130#
 */
 
 $menuecat = "01acp_filemanager";
 $sitetitle = "Datei- &amp; Bildverwaltung";
-$filename = $_SERVER['PHP_SELF'];
+$filename = $_SERVER['SCRIPT_NAME'];
 $mootools_use = array("moo_core","moo_more","moo_remooz","moo_request","moo_dragdrop");
 
 
 if(!isset($_REQUEST['type'])) $_REQUEST['type'] = "";
 if(!isset($_REQUEST['search'])) $_REQUEST['search'] = "";
diff --git a/01acp/index.php b/01acp/index.php
index 926460f..4d82e27 100644
--- a/01acp/index.php
+++ b/01acp/index.php
@@ -10,11 +10,11 @@
 */
 
 $dontshow = true;
 $menuecat = "login";
 $sitetitle = "Anmelden";
-$filename = $_SERVER['PHP_SELF'];
+$filename = $_SERVER['SCRIPT_NAME'];
 $message = "";
 $menge = 0;
 $error = 1;
 $des_cookie = "";
 
diff --git a/01acp/module.php b/01acp/module.php
index cb2b627..c39fe41 100644
--- a/01acp/module.php
+++ b/01acp/module.php
@@ -9,11 +9,11 @@
 	#fv.130#
 */
 
 $menuecat = "01acp_module";
 $sitetitle = "Module verwalten";
-$filename = $_SERVER['PHP_SELF'];
+$filename = $_SERVER['SCRIPT_NAME'];
 $flag_stopupdate = FALSE;
 
 // Config-Dateien
 include("system/main.php");
 include("system/head.php");
diff --git a/01acp/rights.php b/01acp/rights.php
index 13e9e16..083a14c 100644
--- a/01acp/rights.php
+++ b/01acp/rights.php
@@ -9,11 +9,11 @@
 	#fv.130#
 */
 
 $menuecat = "01acp_users";
 $sitetitle = "Benutzerverwaltung : Rechteverwaltung";
-$filename = $_SERVER['PHP_SELF'];
+$filename = $_SERVER['SCRIPT_NAME'];
 
 // Config-Dateien
 include("system/main.php");
 include("system/head.php");
 
diff --git a/01acp/settings.php b/01acp/settings.php
index db8501c..10cec73 100644
--- a/01acp/settings.php
+++ b/01acp/settings.php
@@ -9,11 +9,11 @@
 	#fv.130#
 */
 
 $menuecat = "01acp_settings";
 $sitetitle = "Einstellungen";
-$filename = $_SERVER['PHP_SELF'];
+$filename = $_SERVER['SCRIPT_NAME'];
 
 // Config-Dateien
 include("system/main.php");
 include("system/head.php");
 
diff --git a/01acp/system/uploader.php b/01acp/system/uploader.php
index 34d8124..ab64aab 100644
--- a/01acp/system/uploader.php
+++ b/01acp/system/uploader.php
@@ -7,11 +7,11 @@
 	Modul:		01ACP
 	Dateiinfo:	Formular & Logik für Dateiupload + Ausgabe innerhalb des TinyMCE-Editor
 	#fv.130#
 */
 
-if(!isset($filename)) $filename = $_SERVER['PHP_SELF'];
+if(!isset($filename)) $filename = $_SERVER['SCRIPT_NAME'];
 if(!isset($_REQUEST['formname'])) $_REQUEST['formname'] = "";
 if(!isset($_REQUEST['type'])) $_REQUEST['type'] = "";
 if(!isset($_REQUEST['returnvalue'])) $_REQUEST['returnvalue'] = "";
 if(!isset($_REQUEST['formfield'])) $_REQUEST['formfield'] = "";
 if(!isset($_REQUEST['look'])) $_REQUEST['look'] = "";
diff --git a/01acp/update.php b/01acp/update.php
index 7309569..5f1e29a 100644
--- a/01acp/update.php
+++ b/01acp/update.php
@@ -9,11 +9,11 @@
 	#fv.1200#
 */
 
 $menuecat = "01acp_start";
 $sitetitle = "01ACP aktualisieren";
-$filename = $_SERVER['PHP_SELF'];
+$filename = $_SERVER['SCRIPT_NAME'];
 $flag_acp = TRUE;
 $flag_nofunctions = TRUE;
 $flag_loginerror = FALSE;
 $flag_stopupdate = FALSE;
 $mootools_use = array(); 
diff --git a/01acp/users.php b/01acp/users.php
index 889c5c8..62aabff 100644
--- a/01acp/users.php
+++ b/01acp/users.php
@@ -9,11 +9,11 @@
 	#fv.131#
 */
 
 $menuecat = "01acp_users";
 $sitetitle = "Benutzerverwaltung";
-$filename = $_SERVER['PHP_SELF'];
+$filename = $_SERVER['SCRIPT_NAME'];
 $mootools_use = array("moo_core","moo_more","moo_slidev");
 
 // Config-Dateien
 include("system/main.php");
 include("system/head.php");

Vulnerable code: $filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF']."?modul=".$modul."&amp;loadpage=".$_REQUEST['loadpage'];
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF']."?modul=".$modul."";
		create_ModulForm($_SERVER['PHP_SELF']."?","input",TRUE)."</div>";
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];
if(!isset($filename)) $filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];
$filename = $_SERVER['PHP_SELF'];
Fixed code: $filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME']."?modul=".$modul."&amp;loadpage=".$_REQUEST['loadpage'];
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME']."?modul=".$modul."";
		create_ModulForm($_SERVER['SCRIPT_NAME']."?","input",TRUE)."</div>";
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];
if(!isset($filename)) $filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];
$filename = $_SERVER['SCRIPT_NAME'];