Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2022-0721: Insufficient Information (NVD-CWE-noinfo)
value: Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 6.5
Published: 2022-02-23T11:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/Exceptions/Handler.php
Commit date: 2022-02-22 12:35:12 +0200
Commit message: Update Handler.php

Diff: diff --git a/src/MicroweberPackages/App/Exceptions/Handler.php b/src/MicroweberPackages/App/Exceptions/Handler.php
index b0efd1123e6..29d48e8b048 100644
--- a/src/MicroweberPackages/App/Exceptions/Handler.php
+++ b/src/MicroweberPackages/App/Exceptions/Handler.php
@@ -10,13 +10,13 @@ class Handler extends ExceptionHandler
     /**
      * A list of the exception types that are not reported.
      *
      * @var array
      */
-//    protected $dontReport = [
-//        //
-//    ];
+    protected $dontReport = [
+        \BadMethodCallException::class,
+    ];
 
     /**
      * A list of the inputs that are never flashed for validation exceptions.
      *
      * @var array
@@ -100,12 +100,12 @@ class Handler extends ExceptionHandler
                 <h3>Try to fix it by yourself using following buttons.</h3>
                 <br />
                  <a href="' . api_url('mw_post_update') . '?redirect_to='.url_current().'" class="btn">Reload database</a>
                  <a href="' . api_url('mw_reload_modules') . '?redirect_to='.url_current().'" class="btn">Reload modules</a>
                  <a href="' . api_url('clearcache') . '?redirect_to='.url_current().'" class="btn">Clear cache</a>
-                 
+
                  <a href="" class="btn">Refresh</a>
             </div>
         </div>
         ';
     }
-}
\ No newline at end of file
+}

Vulnerable code: //    protected $dontReport = [
//        //
//    ];
                 
}
Fixed code:     protected $dontReport = [
        \BadMethodCallException::class,
    ];

}
CVE-2022-0723: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-26T11:15Z
Repository: https://github.com/microweber/microweber
Language: Unknown
Commit date: 2022-02-25 12:57:48 +0200
Commit message: update

Diff: diff --git a/.github/workflows/templates.yml.backup b/.github/workflows/templates.yml
similarity index 100%
rename from .github/workflows/templates.yml.backup
rename to .github/workflows/templates.yml
CVE-2022-0724: Insecure Storage of Sensitive Information (CWE-922)
value: Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
CWE description: The product stores sensitive information without properly limiting read or write access by unauthorized actors.
CVSS v3 base score: 6.5
Published: 2022-02-23T11:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/functions/plupload.php
Commit date: 2022-02-22 13:07:12 +0200
Commit message: Update plupload.php

Diff: diff --git a/src/MicroweberPackages/App/functions/plupload.php b/src/MicroweberPackages/App/functions/plupload.php
index 07de3dbfadf..d19e56c404b 100644
--- a/src/MicroweberPackages/App/functions/plupload.php
+++ b/src/MicroweberPackages/App/functions/plupload.php
@@ -520,26 +520,26 @@ if (!$chunks || $chunk == $chunks - 1) {
             if ($ext === 'jpg' || $ext === 'jpeg' || $ext === 'jpe') {
 
                 // This will clear exif data - security issue
                 $imgCreatedFromJpeg = @imagecreatefromjpeg($filePath);
                 if ($imgCreatedFromJpeg) {
-                    imagejpeg($imgCreatedFromJpeg, $filePath,100);
+                    imagejpeg($imgCreatedFromJpeg, $filePath,100);  // this will create fresh new image without exif sensitive data
                     $valid = true;
                 }
             } else if ($ext === 'png') {
 
                 $imgCreatedFromPng = @imagecreatefrompng($filePath);
                 if ($imgCreatedFromPng) {
-                    imagepng($imgCreatedFromPng, $filePath,100);
+                    imagepng($imgCreatedFromPng, $filePath,100);  // this will create fresh new image without exif sensitive data
                     $valid = true;
                 }
 
             } else if ($ext === 'gif') {
 
                 $imgCreatedFromGif = @imagecreatefromgif($filePath);
                 if ($imgCreatedFromGif) {
-                    imagegif($imgCreatedFromGif, $filePath,100);
+                    imagegif($imgCreatedFromGif, $filePath,100); // this will create fresh new image without exif sensitive data
                     $valid = true;
                 }
 
             } else if ($ext === 'svg') {
 

Vulnerable code:                     imagejpeg($imgCreatedFromJpeg, $filePath,100);
                    imagepng($imgCreatedFromPng, $filePath,100);
                    imagegif($imgCreatedFromGif, $filePath,100);
Fixed code:                     imagejpeg($imgCreatedFromJpeg, $filePath,100);  // this will create fresh new image without exif sensitive data
                    imagepng($imgCreatedFromPng, $filePath,100);  // this will create fresh new image without exif sensitive data
                    imagegif($imgCreatedFromGif, $filePath,100); // this will create fresh new image without exif sensitive data
CVE-2022-0762: Incorrect Authorization (CWE-863)
value: Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.


CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 4.3
Published: 2022-02-26T10:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Cart/CartManager.php
Commit date: 2022-02-25 11:43:45 +0200
Commit message: check product is deleted before add to cart

Diff: diff --git a/src/MicroweberPackages/Cart/CartManager.php b/src/MicroweberPackages/Cart/CartManager.php
index 2b2ff36eab9..3addd09d354 100644
--- a/src/MicroweberPackages/Cart/CartManager.php
+++ b/src/MicroweberPackages/Cart/CartManager.php
@@ -563,11 +563,25 @@ class CartManager extends Crud
         if ($update_qty > 0) {
             $data['qty'] = $update_qty;
         }
 
         if ($data['for'] == 'content') {
+
             $cont = $this->app->content_manager->get_by_id($for_id);
+
+            if (isset($cont['is_active'])) {
+                if ($cont['is_active'] != 1) {
+                    $cont = false;
+                }
+            }
+
+            if (isset($cont['is_deleted'])) {
+                if ($cont['is_deleted'] > 0) {
+                    $cont = false;
+                }
+            }
+
             $cont_data = $this->app->content_manager->data($for_id);
             if ($cont == false) {
                 return array('error' => 'Invalid product?');
             } else {
                 if (is_array($cont) and isset($cont['title'])) {

Fixed code: 

            if (isset($cont['is_active'])) {
                if ($cont['is_active'] != 1) {
                    $cont = false;
                }
            }

            if (isset($cont['is_deleted'])) {
                if ($cont['is_deleted'] > 0) {
                    $cont = false;
                }
            }
CVE-2022-0763: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-02-26T10:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Media/MediaManager.php
Commit date: 2022-02-25 11:57:42 +0200
Commit message: add xss clean to create media dir method

Diff: diff --git a/src/MicroweberPackages/Media/MediaManager.php b/src/MicroweberPackages/Media/MediaManager.php
index 1ed03ac0085..eca46fa89bb 100644
--- a/src/MicroweberPackages/Media/MediaManager.php
+++ b/src/MicroweberPackages/Media/MediaManager.php
@@ -2,10 +2,11 @@
 
 namespace MicroweberPackages\Media;
 
 use Conner\Tagging\Model\Tagged;
 use \Intervention\Image\ImageManagerStatic as Image;
+use MicroweberPackages\Helper\HTMLClean;
 use MicroweberPackages\Media\Models\Media;
 use MicroweberPackages\Media\Models\MediaThumbnail;
 use MicroweberPackages\Utils\Media\Thumbnailer;
 use MicroweberPackages\Utils\System\Files;
 
@@ -1182,10 +1183,14 @@ class MediaManager
     }
 
 
     public function create_media_dir($params)
     {
+
+        $clean = new HTMLClean();
+        $_REQUEST = $clean->cleanArray($_REQUEST);
+
         must_have_access();
         $resp = array();
         // $target_path = media_base_path() . 'uploaded' . DS;
         $target_path = media_uploads_path();
         $fn_path = media_base_path();
@@ -1196,11 +1201,11 @@ class MediaManager
             $fn_path = str_replace('..', '', $fn_path);
             $fn_path = normalize_path($fn_path, false);
 
             $target_path = $fn_path;
         }
-        if (!isset($_REQUEST['name'])) {
+        if (!isset($_REQUEST['name']) || empty($_REQUEST['name'])) {
             $resp = array('error' => 'You must send new_folder parameter');
         } else {
             $fn_new_folder_path = $_REQUEST['name'];
             $fn_new_folder_path = urldecode($fn_new_folder_path);
             $fn_new_folder_path = str_replace('..', '', $fn_new_folder_path);

Vulnerable code:         if (!isset($_REQUEST['name'])) {
Fixed code: use MicroweberPackages\Helper\HTMLClean;

        $clean = new HTMLClean();
        $_REQUEST = $clean->cleanArray($_REQUEST);

        if (!isset($_REQUEST['name']) || empty($_REQUEST['name'])) {
CVE-2022-0895: Other (NVD-CWE-Other)
value: Static Code Injection in GitHub repository microweber/microweber prior to 1.3.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 9.8
Published: 2022-03-10T11:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Checkout/Http/Controllers/Traits/ContactInformationTrait.php
Commit date: 2022-03-09 13:13:43 +0200
Commit message: Update ContactInformationTrait.php

Diff: diff --git a/src/MicroweberPackages/Checkout/Http/Controllers/Traits/ContactInformationTrait.php b/src/MicroweberPackages/Checkout/Http/Controllers/Traits/ContactInformationTrait.php
index 626328e59db..c7d679495df 100644
--- a/src/MicroweberPackages/Checkout/Http/Controllers/Traits/ContactInformationTrait.php
+++ b/src/MicroweberPackages/Checkout/Http/Controllers/Traits/ContactInformationTrait.php
@@ -34,15 +34,20 @@ trait ContactInformationTrait {
         return $this->_renderView('checkout::contact_information',$data);
     }
 
     public function contactInformationSave(Request $request) {
 
+        $firstName = strip_tags($request->get('first_name'));
+        $lastName = strip_tags($request->get('last_name'));
+        $email = strip_tags($request->get('email'));
+        $phone = strip_tags($request->get('phone'));
+
         session_append_array('checkout_v2', [
-            'first_name'=> $request->get('first_name'),
-            'last_name'=> $request->get('last_name'),
-            'email'=> $request->get('email'),
-            'phone'=> $request->get('phone')
+            'first_name'=> $firstName,
+            'last_name'=> $lastName,
+            'email'=> $email,
+            'phone'=> $phone
         ]);
 
         $validate = $this->_validateContactInformation($request->all());
         if ($validate['valid'] == false) {
             session_set('errors', $validate['errors']);

Vulnerable code:             'first_name'=> $request->get('first_name'),
            'last_name'=> $request->get('last_name'),
            'email'=> $request->get('email'),
            'phone'=> $request->get('phone')
Fixed code:         $firstName = strip_tags($request->get('first_name'));
        $lastName = strip_tags($request->get('last_name'));
        $email = strip_tags($request->get('email'));
        $phone = strip_tags($request->get('phone'));

            'first_name'=> $firstName,
            'last_name'=> $lastName,
            'email'=> $email,
            'phone'=> $phone
CVE-2022-0906: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-03-10T15:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Utils/System/Files.php
Commit date: 2022-03-09 16:55:02 +0200
Commit message: update

Diff: diff --git a/src/MicroweberPackages/Utils/System/Files.php b/src/MicroweberPackages/Utils/System/Files.php
index 5e3ff8bfffda..220d42fdf0a1 100644
--- a/src/MicroweberPackages/Utils/System/Files.php
+++ b/src/MicroweberPackages/Utils/System/Files.php
@@ -589,10 +589,11 @@ class Files
             'cgi',
             'rb',
             'py',
             'alfa',
             'asp',
+            'aspx',
             'htaccess',
             'exe',
             'msi',
             'sh',
             'bat',

Fixed code:             'aspx',
CVE-2022-0929: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-03-12T11:15Z
Repository: https://github.com/microweber/microweber
Language: YAML
Files changed: .github/workflows/build-and-upload.yml
Commit date: 2022-03-11 15:38:50 +0200
Commit message: Update build-and-upload.yml

Diff: diff --git a/.github/workflows/build-and-upload.yml b/.github/workflows/build-and-upload.yml
index 259ee2be29d4..74b2a62a4415 100644
--- a/.github/workflows/build-and-upload.yml
+++ b/.github/workflows/build-and-upload.yml
@@ -4,11 +4,10 @@ on:
   push:
 
 jobs:
   microweber-test-before-build:
     runs-on: ubuntu-latest
-    needs: stop-previous-runs
     steps:
       - uses: actions/checkout@v2
 
       - name: Install Dependencies
         run: composer install

Vulnerable code:     needs: stop-previous-runs
CVE-2022-0961: Integer Overflow or Wraparound (CWE-190)
value: The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.
CWE description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
CVSS v3 base score: 5.5
Published: 2022-03-15T15:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Post/Http/Requests/PostRequest.php
Commit date: 2022-03-14 17:00:22 +0200
Commit message: Update PostRequest.php

Diff: diff --git a/src/MicroweberPackages/Post/Http/Requests/PostRequest.php b/src/MicroweberPackages/Post/Http/Requests/PostRequest.php
index 597a68a2f9cd..f76f08104685 100644
--- a/src/MicroweberPackages/Post/Http/Requests/PostRequest.php
+++ b/src/MicroweberPackages/Post/Http/Requests/PostRequest.php
@@ -20,12 +20,19 @@ class PostRequest extends FormRequest
      *
      * @return array
      */
     public function rules()
     {
+        // todo with multilanguage
+
         $rules = [
-           // 'title' => 'required', // todo with multilanguage
+            'title' => 'required|max:500',
+            'url' => 'max:500',
+            'description' => 'max:500',
+            'content_meta_title' => 'max:500',
+            'content_meta_keywords' => 'max:500',
+            'original_link' => 'max:500',
         ];
 
         return $rules;
     }
 }

Vulnerable code:            // 'title' => 'required', // todo with multilanguage
Fixed code:         // todo with multilanguage

            'title' => 'required|max:500',
            'url' => 'max:500',
            'description' => 'max:500',
            'content_meta_title' => 'max:500',
            'content_meta_keywords' => 'max:500',
            'original_link' => 'max:500',
CVE-2022-0963: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-03-15T16:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Utils/System/Files.php
Commit date: 2022-03-14 17:29:28 +0200
Commit message: Update Files.php

Diff: diff --git a/src/MicroweberPackages/Utils/System/Files.php b/src/MicroweberPackages/Utils/System/Files.php
index b9542762a827..c3567cb2aa09 100644
--- a/src/MicroweberPackages/Utils/System/Files.php
+++ b/src/MicroweberPackages/Utils/System/Files.php
@@ -1152,15 +1152,15 @@ class Files
             case 'videos':
                 $are_allowed .= ',avi,asf,mpg,mpeg,mp4,flv,mkv,webm,ogg,ogv,3gp,3g2,wma,mov,wmv';
                 break;
             case 'file':
             case 'files':
-                $are_allowed .= ',doc,docx,pdf,json,rtf,txt,zip,gzip,rar,cad,xml,psd,xlsx,csv,7z';
+                $are_allowed .= ',doc,docx,pdf,json,rtf,txt,zip,gzip,rar,cad,psd,xlsx,csv,7z'; 
                 break;
             case 'documents':
             case 'doc':
-                $are_allowed .= ',doc,docx,pdf,log,msg,odt,pages,rtf,tex,txt,wpd,wps,pps,ppt,pptx,xml,xlr,xls,xlsx';
+                $are_allowed .= ',doc,docx,pdf,log,msg,odt,pages,rtf,tex,txt,wpd,wps,pps,ppt,pptx,xlr,xls,xlsx';
                 break;
             case 'archives':
             case 'arc':
             case 'arch':
                 $are_allowed .= ',zip,zipx,gzip,rar,gz,7z,cbr,tar.gz';

Vulnerable code:                 $are_allowed .= ',doc,docx,pdf,json,rtf,txt,zip,gzip,rar,cad,xml,psd,xlsx,csv,7z';
                $are_allowed .= ',doc,docx,pdf,log,msg,odt,pages,rtf,tex,txt,wpd,wps,pps,ppt,pptx,xml,xlr,xls,xlsx';
Fixed code:                 $are_allowed .= ',doc,docx,pdf,json,rtf,txt,zip,gzip,rar,cad,psd,xlsx,csv,7z'; 
                $are_allowed .= ',doc,docx,pdf,log,msg,odt,pages,rtf,tex,txt,wpd,wps,pps,ppt,pptx,xlr,xls,xlsx';
CVE-2022-1439: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-04-22T17:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/Http/Controllers/ApiController.php
Commit date: 2022-04-22 19:26:41 +0300
Commit message: update

Diff: diff --git a/src/MicroweberPackages/App/Http/Controllers/ApiController.php b/src/MicroweberPackages/App/Http/Controllers/ApiController.php
index 6d628263d5b9..9e72121a9e65 100644
--- a/src/MicroweberPackages/App/Http/Controllers/ApiController.php
+++ b/src/MicroweberPackages/App/Http/Controllers/ApiController.php
@@ -609,22 +609,27 @@ class ApiController  extends FrontendController
         // sanitize attributes
         if($request_data){
             $request_data_new = [];
             $antixss = new AntiXSS();
             foreach ($request_data as $k=>$v){
-
+                if(is_string($v)) {
+                    $v = str_replace('<', '-', $v);
+                    $v = str_replace('>', '-', $v);
+                }
                 $v = $antixss->xss_clean($v);
 
                 if(is_string($k)){
+                    $k = str_replace('<', '-', $k);
+                    $k = str_replace('>', '-', $k);
                     $k = $antixss->xss_clean($k);
                     if($k){
                         $request_data_new[$k] = $v;
                     }
                 } else {
                     $request_data_new[$k] = $v;
                 }
-                
+
             }
             $request_data = $request_data_new;
         }
 
         $page = false;

Fixed code:                 if(is_string($v)) {
                    $v = str_replace('<', '-', $v);
                    $v = str_replace('>', '-', $v);
                }
                    $k = str_replace('<', '-', $k);
                    $k = str_replace('>', '-', $k);
CVE-2022-1555: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie...
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-05-04T09:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Order/resources/views/admin/orders/partials/order_filtering.blade.php
Commit date: 2022-05-03 11:41:32 +0300
Commit message: Update order_filtering.blade.php

Diff: diff --git a/src/MicroweberPackages/Order/resources/views/admin/orders/partials/order_filtering.blade.php b/src/MicroweberPackages/Order/resources/views/admin/orders/partials/order_filtering.blade.php
index 418a4429a5b6..ce243b216bd1 100644
--- a/src/MicroweberPackages/Order/resources/views/admin/orders/partials/order_filtering.blade.php
+++ b/src/MicroweberPackages/Order/resources/views/admin/orders/partials/order_filtering.blade.php
@@ -156,11 +156,11 @@
             }
 
             $(document).ready(function () {
                 var searchOrdersByProduct = new mw.autoComplete({
                     element: "#js-orders-search-by-products",
-                    placeholder: "<?php if ($productKeyword) { echo $productKeyword; } else { _e("Search by products..."); }?>",
+                    placeholder: "<?php if ($productKeyword) { echo xss_clean($productKeyword); } else { _e("Search by products..."); }?>",
                     autoComplete:true,
                     ajaxConfig: {
                         method: 'get',
                         url: mw.settings.api_url + 'get_content_admin?get_extra_data=1&content_type=product&keyword=${val}'
                     },

Vulnerable code:                     placeholder: "<?php if ($productKeyword) { echo $productKeyword; } else { _e("Search by products..."); }?>",
Fixed code:                     placeholder: "<?php if ($productKeyword) { echo xss_clean($productKeyword); } else { _e("Search by products..."); }?>",
CVE-2022-1584: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-05-04T18:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/Http/Controllers/ApiController.php, src/MicroweberPackages/Helper/XSSClean.php
Commit date: 2022-05-04 19:59:38 +0300
Commit message: update

Diff: diff --git a/src/MicroweberPackages/App/Http/Controllers/ApiController.php b/src/MicroweberPackages/App/Http/Controllers/ApiController.php
index 3410786e395f..a59dbf8fb0fa 100644
--- a/src/MicroweberPackages/App/Http/Controllers/ApiController.php
+++ b/src/MicroweberPackages/App/Http/Controllers/ApiController.php
@@ -614,20 +614,24 @@ class ApiController  extends FrontendController
 
             foreach ($request_data as $k=>$v){
                 if(is_string($v)) {
                     $v = str_replace('<', '-', $v);
                     $v = str_replace('>', '-', $v);
+                    $v = str_replace('"', '-', $v);
+                    $v = str_replace("'", '-', $v);
                 }
                 if(is_array($v)) {
                     $v = $xssClean->cleanArray($v);
                 } else {
                     $v = $xssClean->clean($v);
                 }
 
                 if(is_string($k)){
                     $k = str_replace('<', '-', $k);
                     $k = str_replace('>', '-', $k);
+                    $k = str_replace('"', '-', $k);
+                    $k = str_replace("'", '-', $k);
 
                     $k = $xssClean->clean($k);
                     if($k){
                         $request_data_new[$k] = $v;
                     }
diff --git a/src/MicroweberPackages/Helper/XSSClean.php b/src/MicroweberPackages/Helper/XSSClean.php
index c88a99988f9e..7a512cd84cea 100644
--- a/src/MicroweberPackages/Helper/XSSClean.php
+++ b/src/MicroweberPackages/Helper/XSSClean.php
@@ -97,10 +97,11 @@ class XSSClean
             'ondragend',
             'ondragenter',
             'ondragleave',
             'ondragover',
             'ondragstart',
+            'ondragexit',
             'ondrop',
             'onfocusout',
             'onfullscreenchange',
             'oninput',
             'oninvalid',

Fixed code:                     $v = str_replace('"', '-', $v);
                    $v = str_replace("'", '-', $v);
                    $k = str_replace('"', '-', $k);
                    $k = str_replace("'", '-', $k);
            'ondragexit',
CVE-2022-2130: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-06-20T09:15Z
Repository: https://github.com/microweber/microweber
Language: Unknown
Commit date: 2022-06-20 10:58:29 +0300
Commit message: Merge branch 'dev' of github.com:microweber/microweber into dev
CVE-2022-2252: URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
value: Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.
CWE description: A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CVSS v3 base score: 6.1
Published: 2022-06-29T16:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Helper/UrlManager.php
Commit date: 2022-06-29 18:14:26 +0300
Commit message: update

Diff: diff --git a/src/MicroweberPackages/Helper/UrlManager.php b/src/MicroweberPackages/Helper/UrlManager.php
index f848092abadf..d8535116544c 100644
--- a/src/MicroweberPackages/Helper/UrlManager.php
+++ b/src/MicroweberPackages/Helper/UrlManager.php
@@ -103,11 +103,19 @@ class UrlManager
         $url = str_ireplace('Location:', '', $url);
         $url = trim($url);
 
         $redirectUrl = site_url();
         $parseUrl = parse_url($url);
+
         if (isset($parseUrl['host'])) {
+            if(isset($parseUrl['user']) and $parseUrl['user']){
+                return \Redirect::to(site_url());
+            }
+
+            if(isset($parseUrl['pass']) and $parseUrl['pass']){
+                return \Redirect::to(site_url());
+            }
             if ($parseUrl['host'] == site_hostname()) {
                 $redirectUrl = $url;
             }
         }
 

Fixed code: 
            if(isset($parseUrl['user']) and $parseUrl['user']){
                return \Redirect::to(site_url());
            }

            if(isset($parseUrl['pass']) and $parseUrl['pass']){
                return \Redirect::to(site_url());
            }
CVE-2022-2280: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-07-01T09:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/functions/plupload.php
Commit date: 2022-07-01 11:07:47 +0300
Commit message: update

Diff: diff --git a/src/MicroweberPackages/App/functions/plupload.php b/src/MicroweberPackages/App/functions/plupload.php
index 3b6e31707cb3..244980968cef 100644
--- a/src/MicroweberPackages/App/functions/plupload.php
+++ b/src/MicroweberPackages/App/functions/plupload.php
@@ -334,13 +334,16 @@ $fileName = $fileName . '.' . $fileNameExtension;
 
 $fileName_uniq = date('ymdhis') . uniqid() . $fileName;
 // Make sure the fileName is unique but only if chunking is disabled
 if ($chunks < 2 && file_exists($targetDir . DIRECTORY_SEPARATOR . $fileName)) {
     $ext = strrpos($fileName, '.');
+
     $fileName_a = substr($fileName, 0, $ext);
     $fileName_b = substr($fileName, $ext);
 
+    $fileName_b = strtolower($fileName_b);
+
     $count = 1;
     while (file_exists($targetDir . DIRECTORY_SEPARATOR . $fileName_a . '_' . $count . $fileName_b)) {
         ++$count;
     }
 
@@ -498,11 +501,11 @@ if (!$chunks || $chunk == $chunks - 1) {
     $automatic_image_resize_on_upload = get_option('automatic_image_resize_on_upload', 'website') == 'y';
     $automatic_image_resize_on_upload_disabled = get_option('automatic_image_resize_on_upload', 'website') == 'd';
 
     if (is_file($filePath) and !$chunks || $chunk == $chunks - 1) {
         $ext = get_file_extension($filePath);
-
+        $ext = strtolower($ext);
         if (function_exists('finfo_open') and function_exists('finfo_file')) {
             $finfo = finfo_open(FILEINFO_MIME_TYPE); // return mime type ala mimetype extension
             $mime = @finfo_file($finfo, $filePath);
             if ($mime) {
                 $upl_mime_ext = explode('/', $mime);

Fixed code: 
    $fileName_b = strtolower($fileName_b);

        $ext = strtolower($ext);
CVE-2022-2300: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-07-04T11:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/Utils/System/Files.php
Commit date: 2022-07-04 11:02:08 +0300
Commit message: update

Diff: diff --git a/src/MicroweberPackages/Utils/System/Files.php b/src/MicroweberPackages/Utils/System/Files.php
index ff10123e4f32..481fc4bc8dfb 100644
--- a/src/MicroweberPackages/Utils/System/Files.php
+++ b/src/MicroweberPackages/Utils/System/Files.php
@@ -1152,15 +1152,15 @@ class Files
             case 'videos':
                 $are_allowed .= ',avi,asf,mpg,mpeg,mp4,flv,mkv,webm,ogg,ogv,3gp,3g2,wma,mov,wmv';
                 break;
             case 'file':
             case 'files':
-                $are_allowed .= ',css,json,zip,gzip,csv,7z';
+                $are_allowed .= ',css,json,zip,gzip,psd,csv,7z';
                 break;
             case 'documents':
             case 'doc':
-                $are_allowed .= ',doc,docx,pdf,odt,pages,rtf,txt,pps,ppt,pptx,xls,xlsx';
+                $are_allowed .= ',doc,docx,pdf,odt,rtf,txt,pps,ppt,pptx,xls,xlsx';
                 break;
             case 'archives':
             case 'arc':
             case 'arch':
                 $are_allowed .= ',zip,zipx,gzip,rar,gz,7z,cbr,tar.gz';

Vulnerable code:                 $are_allowed .= ',css,json,zip,gzip,csv,7z';
                $are_allowed .= ',doc,docx,pdf,odt,pages,rtf,txt,pps,ppt,pptx,xls,xlsx';
Fixed code:                 $are_allowed .= ',css,json,zip,gzip,psd,csv,7z';
                $are_allowed .= ',doc,docx,pdf,odt,rtf,txt,pps,ppt,pptx,xls,xlsx';
CVE-2022-2353: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.1
Published: 2022-07-09T09:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php
Commit date: 2022-07-08 20:31:13 +0300
Commit message: update

Diff: diff --git a/userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php b/userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php
index a6bc6821ccda..b8a55eed45da 100644
--- a/userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php
+++ b/userfiles/modules/microweber/toolbar/editor_tools/module_settings/index.php
@@ -85,18 +85,28 @@
     <?php
     $autoSize = true;
     if (isset($_GET['autosize'])) {
         $autoSize = $_GET['autosize'];
     }
-    $autoSize = xss_clean($autoSize);
+    $autoSize = intval($autoSize);
 
     $type = '';
     if (isset($_GET['type'])) {
         $type = $_GET['type'];
     }
     $type = xss_clean($type);
 
+            $other = [
+                ';',
+                '\'',
+                '//',
+                '`',
+                '\\',
+
+            ];
+    $type = str_replace($other, '', $type);
+
     $mod_id = $mod_orig_id = false;
     $is_linked_mod = false;
 
     if (isset($params['id'])) {
         $mod_orig_id = $mod_id = $params['id'];
@@ -106,10 +116,12 @@
         $mod_orig_id = $params['data-module-original-id'];
     }
     if ($mod_id != $mod_orig_id) {
         $is_linked_mod = true;
     }
+
+
     ?>
 
     <script type="text/javascript">
         addIcon = function () {
             if (window.thismodal && thismodal.main) {
@@ -122,11 +134,11 @@
             }
         };
         addIcon();
 
         autoSize = <?php  print $autoSize; ?>;
-        settingsType = '<?php print $type; ?>';
+        settingsType = '<?php print htmlentities($type); ?>';
 
         window.onbeforeunload = function () {
             $(document.body).addClass("mw-external-loading")
             window.parent.$('.module-modal-settings-menu-holder').remove();
         };

Vulnerable code:     $autoSize = xss_clean($autoSize);
        settingsType = '<?php print $type; ?>';
Fixed code:     $autoSize = intval($autoSize);
            $other = [
                ';',
                '\'',
                '//',
                '`',
                '\\',

            ];
    $type = str_replace($other, '', $type);



        settingsType = '<?php print htmlentities($type); ?>';
CVE-2022-2368: Authentication Bypass by Spoofing (CWE-290)
value: Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.


CWE description: This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CVSS v3 base score: 9.8
Published: 2022-07-11T08:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/User/UserManager.php
Commit date: 2022-07-11 10:58:16 +0300
Commit message: update

Diff: diff --git a/src/MicroweberPackages/User/UserManager.php b/src/MicroweberPackages/User/UserManager.php
index 4852a33bfc6d..aad56c240cef 100644
--- a/src/MicroweberPackages/User/UserManager.php
+++ b/src/MicroweberPackages/User/UserManager.php
@@ -186,10 +186,22 @@ class UserManager
         $check2 = $this->app->log_manager->get('no_cache=1&is_system=y&count=1&created_at=[mt]10 min ago&updated_at=[lt]10 min&rel_type=login_failed&user_ip=' . user_ip());
         if ($check2 > 25) {
             return array('error' => 'There are ' . $check2 . ' failed login attempts from your IP in the last 10 minutes. You are blocked for 10 minutes!');
         }
 
+
+
+        // third check by server REMOTE_ADDR , if the an atacker spoofs the user headers such as HTTP_X_FORWARDED or HTTP_CLIENT_IP
+        if (isset($_SERVER['REMOTE_ADDR'])) {
+            $check3 = $this->app->log_manager->get('no_cache=1&is_system=y&count=1&created_at=[mt]15 min ago&updated_at=[lt]15 min&rel_type=login_failed&user_ip=' . $_SERVER['REMOTE_ADDR']);
+            if ($check3 > 25) {
+                return array('error' => 'There are ' . $check3 . ' failed login attempts from your IP in the last 15 minutes. You are blocked for 15 minutes!');
+            }
+        }
+
+
+
         if (isset($params['code_login'])) {
             return $this->codeLogin($params['code_login']);
         }
 
         // So we use second parameter

Fixed code: 

        // third check by server REMOTE_ADDR , if the an atacker spoofs the user headers such as HTTP_X_FORWARDED or HTTP_CLIENT_IP
        if (isset($_SERVER['REMOTE_ADDR'])) {
            $check3 = $this->app->log_manager->get('no_cache=1&is_system=y&count=1&created_at=[mt]15 min ago&updated_at=[lt]15 min&rel_type=login_failed&user_ip=' . $_SERVER['REMOTE_ADDR']);
            if ($check3 > 25) {
                return array('error' => 'There are ' . $check3 . ' failed login attempts from your IP in the last 15 minutes. You are blocked for 15 minutes!');
            }
        }
CVE-2022-2495: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-07-22T04:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/functions/plupload.php
Commit date: 2022-07-08 16:41:01 +0300
Commit message: update

Diff: diff --git a/src/MicroweberPackages/App/functions/plupload.php b/src/MicroweberPackages/App/functions/plupload.php
index 244980968cef..5890b2ae9ff3 100644
--- a/src/MicroweberPackages/App/functions/plupload.php
+++ b/src/MicroweberPackages/App/functions/plupload.php
@@ -561,21 +561,29 @@ if (!$chunks || $chunk == $chunks - 1) {
 
                     $valid = true;
                 }
 
             } else if ($ext === 'svg') {
-
+                $valid = false;
                 if (is_file($filePath)) {
                     $sanitizer = new \enshrined\svgSanitize\Sanitizer();
                     // Load the dirty svg
                     $dirtySVG = file_get_contents($filePath);
                      // Pass it to the sanitizer and get it back clean
-                    $cleanSVG = $sanitizer->sanitize($dirtySVG);
-                    file_put_contents($filePath, $cleanSVG);
+                    try {
+                        $cleanSVG = $sanitizer->sanitize($dirtySVG);
+                        $valid = true;
+                    } catch (\Exception $e) {
+                        $valid = false;
+                    }
+
+                    if ($valid) {
+                        file_put_contents($filePath, $cleanSVG);
+                    }
 
                 }
-               $valid = true;
+
 
             } else {
                 $valid = false;
             }
 

Vulnerable code: 
                    $cleanSVG = $sanitizer->sanitize($dirtySVG);
                    file_put_contents($filePath, $cleanSVG);
               $valid = true;
Fixed code:                 $valid = false;
                    try {
                        $cleanSVG = $sanitizer->sanitize($dirtySVG);
                        $valid = true;
                    } catch (\Exception $e) {
                        $valid = false;
                    }

                    if ($valid) {
                        file_put_contents($filePath, $cleanSVG);
                    }
CVE-2022-2777: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.1.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-08-11T11:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/App/Http/Middleware/XSS.php
Commit date: 2022-08-11 12:41:20 +0300
Commit message: update

Diff: diff --git a/src/MicroweberPackages/App/Http/Middleware/XSS.php b/src/MicroweberPackages/App/Http/Middleware/XSS.php
index 1880ad602d1e..23e10a16f26a 100644
--- a/src/MicroweberPackages/App/Http/Middleware/XSS.php
+++ b/src/MicroweberPackages/App/Http/Middleware/XSS.php
@@ -12,20 +12,20 @@ class XSS
     public function handle(Request $request, Closure $next)
     {
         $input = $request->all();
 
 
-        if ($request->isMethod('post') and !empty($input)) {
+        if (($request->isMethod('post')  or $request->isMethod('patch')) and !empty($input)) {
+
             $clean = new HTMLClean();
             array_walk_recursive($input, function (&$input) use ($clean) {
                 if (is_string($input)) {
                     $input = $clean->clean($input);
                 }
             });
         }
 
-
         $request->merge($input);
         return $next($request);
     }
 
 }

Vulnerable code:         if ($request->isMethod('post') and !empty($input)) {

Fixed code:         if (($request->isMethod('post')  or $request->isMethod('patch')) and !empty($input)) {
CVE-2022-3245: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-09-20T14:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: userfiles/modules/tags/edit_tagging_tag.php
Commit date: 2022-09-20 15:11:56 +0300
Commit message: update

Diff: diff --git a/userfiles/modules/tags/edit_tagging_tag.php b/userfiles/modules/tags/edit_tagging_tag.php
index 495496eb16..b7cf068da4 100644
--- a/userfiles/modules/tags/edit_tagging_tag.php
+++ b/userfiles/modules/tags/edit_tagging_tag.php
@@ -76,11 +76,14 @@ if ($tag) {
 
     });
 
     function getTagButtonHtmlInForm(id,name,slug) {
 
-        var html = '<div class="btn-group tag mb-2 mr-1 btn-tag-id-'+id+'" role="group">' +
+        // remove html from string before display
+        name =  $('<p>' + name + '</p>').text();
+
+         var html = '<div class="btn-group tag mb-2 mr-1 btn-tag-id-'+id+'" role="group">' +
             '    <button type="button" class="btn-sm icon-left no-hover btn btn-secondary" onClick="editTaggingTagReplaceForm('+id+')"><i class="mdi mdi-tag"></i> ' + name + '</button>' +
             '    <button type="button" class="btn btn-primary btn-sm btn-icon" onClick="editTaggingTagReplaceForm('+id+')"><i class="mdi mdi-pencil"></i></button>' +
             '    <button type="button" class="btn btn-primary btn-sm btn-icon" onClick="deleteTaggingTag('+id+')"><i class="mdi mdi-close"></i></button>' +
             '</div>';
 
@@ -137,6 +140,6 @@ if ($tag) {
     <button class="btn btn-success btn-sm" type="submit"><?php _e('Save Tag');?></button>
 </form>
 
 <div class="js-admin-tag-edit-messages" style="padding-top: 15px"></div>
 
-<div class="js-admin-tags mt-3"></div>
\ No newline at end of file
+<div class="js-admin-tags mt-3"></div>

Vulnerable code:         var html = '<div class="btn-group tag mb-2 mr-1 btn-tag-id-'+id+'" role="group">' +
<div class="js-admin-tags mt-3"></div>
Fixed code:         // remove html from string before display
        name =  $('<p>' + name + '</p>').text();

         var html = '<div class="btn-group tag mb-2 mr-1 btn-tag-id-'+id+'" role="group">' +
<div class="js-admin-tags mt-3"></div>
CVE-2022-4617: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-21T01:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: userfiles/modules/settings/group/language_import.php
Commit date: 2022-11-29 15:08:01 +0200
Commit message: update

Diff: diff --git a/userfiles/modules/settings/group/language_import.php b/userfiles/modules/settings/group/language_import.php
index aaab2443353..03ffd8bd576 100644
--- a/userfiles/modules/settings/group/language_import.php
+++ b/userfiles/modules/settings/group/language_import.php
@@ -27,11 +27,11 @@ $(document).ready(function () {
     	postData.replace_values = 1;
         }
 		$.post("<?php echo route('admin.language.import'); ?>", postData,
 			function(msg) {
 				if (msg.success) {
-			    	mw.reload_module('.js-language-edit-browse-<?php echo $_POST['namespaceMD5'];?>');
+			    	mw.reload_module('.js-language-edit-browse-<?php echo xss_clean($_POST['namespaceMD5']);?>');
 			    }
 				mw.notification.msg(msg);
 		});
     });
 

Vulnerable code: 			    	mw.reload_module('.js-language-edit-browse-<?php echo $_POST['namespaceMD5'];?>');
Fixed code: 			    	mw.reload_module('.js-language-edit-browse-<?php echo xss_clean($_POST['namespaceMD5']);?>');