CVE-2024-6526: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This affects an unknown part. The manipulation of the argument search_title/catName/sub/name/categorie leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 1b3da45308bb6c3f55247d0e99620b600bd85277. It is recommended to apply a patch to fix this issue. The identifier VDB-270369 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2024-07-05T14:15Z
Repository: https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap
Language: PHP
Files changed: application/modules/admin/views/ecommerce/products.php, application/modules/admin/views/ecommerce/shopcategories.php, application/modules/admin/views/vendors/listVendors.php, application/views/templates/clothesshop/home.php, application/views/templates/clothesshop/vendor.php, application/views/templates/greenlabel/_parts/footer.php, application/views/templates/greenlabel/_parts/header.php, application/views/templates/greenlabel/shop.php, application/views/templates/greenlabel/vendor.php, application/views/templates/redlabel/_parts/footer.php, application/views/templates/redlabel/home.php, application/views/templates/redlabel/vendor.php
Commit date: 2024-07-03 20:58:50 +0300
Commit message: Multiples xss in the application request to open a CVE #263

Diff: diff --git a/application/modules/admin/views/ecommerce/products.php b/application/modules/admin/views/ecommerce/products.php
index 8c915126..8d1e33aa 100755
--- a/application/modules/admin/views/ecommerce/products.php
+++ b/application/modules/admin/views/ecommerce/products.php
@@ -32,11 +32,11 @@
                             </select>
                         </div>
                         <div class="col-sm-4">
                             <label>Title:</label>
                             <div class="input-group">
-                                <input class="form-control" placeholder="Product Title" type="text" value="<?= isset($_GET['search_title']) ? $_GET['search_title'] : '' ?>" name="search_title">
+                                <input class="form-control" placeholder="Product Title" type="text" value="<?= isset($_GET['search_title']) ? htmlspecialchars($_GET['search_title'], ENT_QUOTES, 'UTF-8') : '' ?>" name="search_title">
                                 <span class="input-group-btn">
                                     <button class="btn btn-default" type="submit" value="">
                                         <i class="fa fa-search"></i>
                                     </button>
                                 </span>
diff --git a/application/modules/admin/views/ecommerce/shopcategories.php b/application/modules/admin/views/ecommerce/shopcategories.php
index 7cf95719..1bf2f77a 100755
--- a/application/modules/admin/views/ecommerce/shopcategories.php
+++ b/application/modules/admin/views/ecommerce/shopcategories.php
@@ -49,17 +49,17 @@
                         $i++;
                     }
                     ?>
                     <tr>
                         <td><?= $key_cat ?></td>
-                        <td><?= $catName ?></td>
+                        <td><?= htmlspecialchars($catName, ENT_QUOTES, 'UTF-8') ?></td>
                         <td> 
                             <a href="javascript:void(0);" class="editCategorieSub" data-sub-for-id="<?= $key_cat ?>">
                                 <i class="fa fa-pencil" aria-hidden="true"></i>
                             </a>
                             <?php foreach ($shop_categorie['sub'] as $sub) { ?>
-                                <div> <?= $sub ?> </div>
+                                <div> <?= htmlspecialchars($sub, ENT_QUOTES, 'UTF-8') ?> </div>
                             <?php } ?>
                         </td>
                         <td>
                             <a href="javascript:void(0);" class="editPosition" data-position-for-id="<?= $key_cat ?>" data-my-position="<?= $shop_categorie['position'] ?>">
                                 <i class="fa fa-pencil" aria-hidden="true"></i>
@@ -107,11 +107,11 @@
                                 <option value="0">None</option>
                                 <?php
                                 foreach ($shop_categories as $key_cat => $shop_categorie) {
                                     $aa = '';
                                     foreach ($shop_categorie['info'] as $ff) {
-                                        $aa .= '[' . $ff['abbr'] . ']' . $ff['name'] . '/';
+                                        $aa .= '[' . $ff['abbr'] . ']' . htmlspecialchars($ff['name'], ENT_QUOTES, 'UTF-8') . '/';
                                     }
                                     ?>
                                     <option value="<?= $key_cat ?>"><?= $aa ?></option>
                                 <?php } ?>
                             </select>
@@ -142,11 +142,11 @@
             <option value="0">None</option>
             <?php
             foreach ($shop_categories as $key_cat => $shop_categorie) {
                 $aa = '';
                 foreach ($shop_categorie['info'] as $ff) {
-                    $aa .= '[' . $ff['abbr'] . ']' . $ff['name'] . '/';
+                    $aa .= '[' . $ff['abbr'] . ']' . htmlspecialchars($ff['name'], ENT_QUOTES, 'UTF-8') . '/';
                 }
                 ?>
                 <option value="<?= $key_cat ?>"><?= $aa ?></option>
             <?php } ?>
         </select>
diff --git a/application/modules/admin/views/vendors/listVendors.php b/application/modules/admin/views/vendors/listVendors.php
index 5b85ced0..8ef416b2 100755
--- a/application/modules/admin/views/vendors/listVendors.php
+++ b/application/modules/admin/views/vendors/listVendors.php
@@ -17,11 +17,11 @@
                     </tr>
                 </thead>
                 <?php foreach ($vendors->result() as $vendor) { ?>
                     <tr>
                         <td><?= $vendor->id ?></td>
-                        <td><?= isset($vendor->name) ? $vendor->name : 'Vendor name is empty' ?></td>
+                        <td><?= isset($vendor->name) ? htmlspecialchars($vendor->name, ENT_QUOTES, 'UTF-8') : 'Vendor name is empty' ?></td>
                         <td><?= $vendor->email ?></td>
                         <td>
                             <?php
                              $orders = $controller->getVendorOrders($vendor->id); 
                              if(!count($orders)) {
@@ -29,11 +29,11 @@
                                 <span class="label label-danger">No orders</span>
                                 <?php
                              } else {
                                 $countSales = 0;
                                 foreach($orders as $order) {
-                                    $product = unserialize($order['products']);
+                                    $product = unserialize($order['products'], ["allowed_classes" => false]);
                                     foreach ($product as $key => $value) {
                                         $countSales += (int)$value;
                                     }
                                 ?>
                                 <span class="label label-success"><?= $countSales ?></span>
diff --git a/application/views/templates/clothesshop/home.php b/application/views/templates/clothesshop/home.php
index 55486a76..cfb0259f 100755
--- a/application/views/templates/clothesshop/home.php
+++ b/application/views/templates/clothesshop/home.php
@@ -95,11 +95,11 @@ foreach ($all_categories as $categorie) {
                     <?php
                     foreach ($arrCategories as $categorie) {
                         ?>
                         <li>
                             <a href="javascript:void(0);" data-categorie-id="<?= $categorie['id'] ?>" class="go-category left-side <?= isset($_GET['category']) && $_GET['category'] == $categorie['id'] ? 'selected' : '' ?>">
-                                <span><?= $categorie['name'] ?></span>
+                                <span><?= htmlspecialchars($categorie['name'], ENT_QUOTES, 'UTF-8') ?></span>
                                 <i class="fa fa-angle-double-down" aria-hidden="true"></i>
                             </a>
                         </li>
                         <?php
                     }
diff --git a/application/views/templates/clothesshop/vendor.php b/application/views/templates/clothesshop/vendor.php
index 75507702..98215380 100644
--- a/application/views/templates/clothesshop/vendor.php
+++ b/application/views/templates/clothesshop/vendor.php
@@ -34,11 +34,11 @@ foreach ($all_categories as $categorie) {
                     <?php
                     foreach ($arrCategories as $categorie) {
                         ?>
                         <li>
                             <a href="javascript:void(0);" data-categorie-id="<?= $categorie['id'] ?>" class="go-category left-side <?= isset($_GET['category']) && $_GET['category'] == $categorie['id'] ? 'selected' : '' ?>">
-                                <span><?= $categorie['name'] ?></span>
+                                <span><?= htmlspecialchars($categorie['name'], ENT_QUOTES, 'UTF-8') ?></span>
                                 <i class="fa fa-angle-double-down" aria-hidden="true"></i>
                             </a>
                         </li>
                         <?php
                     }
diff --git a/application/views/templates/greenlabel/_parts/footer.php b/application/views/templates/greenlabel/_parts/footer.php
index 7ad4282b..10b50815 100644
--- a/application/views/templates/greenlabel/_parts/footer.php
+++ b/application/views/templates/greenlabel/_parts/footer.php
@@ -17,11 +17,11 @@
                 <div class="col-lg-2  col-md-2 col-sm-4 col-xs-6 f-col">
                     <h3><?= lang('categories') ?></h3>
                     <?php if (!empty($footerCategories)) { ?>
                         <ul>
                             <?php foreach ($footerCategories as $key => $categorie) { ?>
-                                <li><a href="javascript:void(0);" data-categorie-id="<?= $key ?>" class="go-category"><?= $categorie ?></a></li>
+                                <li><a href="javascript:void(0);" data-categorie-id="<?= $key ?>" class="go-category"><?= htmlspecialchars($categorie, ENT_QUOTES, 'UTF-8') ?></a></li>
                             <?php } ?>
                         </ul>
                     <?php } else { ?>
                         <p><?= lang('no_categories') ?></p>
                     <?php } ?>
diff --git a/application/views/templates/greenlabel/_parts/header.php b/application/views/templates/greenlabel/_parts/header.php
index d7ffd42f..232dc122 100644
--- a/application/views/templates/greenlabel/_parts/header.php
+++ b/application/views/templates/greenlabel/_parts/header.php
@@ -167,11 +167,11 @@
                                                         $children = false;
                                                         if (isset($nav_category['children']) && !empty($nav_category['children'])) {
                                                             $children = true;
                                                         }
                                                         ?> 
-                                                        <a href="javascript:void(0);" data-categorie-id="<?= $nav_category['id'] ?>" class="go-category <?= $children == true ? 'mega-title' : '' ?>"><?= $nav_category['name'] ?></a>
+                                                        <a href="javascript:void(0);" data-categorie-id="<?= $nav_category['id'] ?>" class="go-category <?= $children == true ? 'mega-title' : '' ?>"><?= htmlspecialchars($nav_category['name'], ENT_QUOTES, 'UTF-8') ?></a>
                                                         <?php
                                                         if ($children === true) {
                                                             loop_tree_nav($nav_category['children'], true);
                                                         }
                                                     }
diff --git a/application/views/templates/greenlabel/shop.php b/application/views/templates/greenlabel/shop.php
index f5ddd1da..90f5b5e3 100644
--- a/application/views/templates/greenlabel/shop.php
+++ b/application/views/templates/greenlabel/shop.php
@@ -42,11 +42,11 @@ defined('BASEPATH') OR exit('No direct script access allowed');
                                             <i class="fa fa-chevron-right" aria-hidden="true"></i>
                                         <?php } else { ?>
                                             <i class="fa fa-circle-o" aria-hidden="true"></i>
                                         <?php } ?>
                                         <a href="javascript:void(0);" data-categorie-id="<?= $page['id'] ?>" class="go-category left-side <?= isset($_GET['category']) && $_GET['category'] == $page['id'] ? 'selected' : '' ?>">
-                                            <?= $page['name'] ?>
+                                            <?= htmlspecialchars($page['name'], ENT_QUOTES, 'UTF-8') ?>
                                         </a>
                                         <?php
                                         if ($children === true) {
                                             loop_tree($page['children'], true);
                                         } else {
diff --git a/application/views/templates/greenlabel/vendor.php b/application/views/templates/greenlabel/vendor.php
index 90bd9798..1db1b3e6 100644
--- a/application/views/templates/greenlabel/vendor.php
+++ b/application/views/templates/greenlabel/vendor.php
@@ -36,11 +36,11 @@ defined('BASEPATH') OR exit('No direct script access allowed');
                                         <i class="fa fa-chevron-right" aria-hidden="true"></i>
                                     <?php } else { ?>
                                         <i class="fa fa-circle-o" aria-hidden="true"></i>
                                     <?php } ?>
                                     <a href="javascript:void(0);" data-categorie-id="<?= $page['id'] ?>" class="go-category left-side <?= isset($_GET['category']) && $_GET['category'] == $page['id'] ? 'selected' : '' ?>">
-                                        <?= $page['name'] ?>
+                                        <?= htmlspecialchars($page['name'], ENT_QUOTES, 'UTF-8') ?>
                                     </a>
                                     <?php
                                     if ($children === true) {
                                         loop_tree($page['children'], true);
                                     } else {
diff --git a/application/views/templates/redlabel/_parts/footer.php b/application/views/templates/redlabel/_parts/footer.php
index 245cc117..80da0efc 100755
--- a/application/views/templates/redlabel/_parts/footer.php
+++ b/application/views/templates/redlabel/_parts/footer.php
@@ -17,11 +17,11 @@
                 <div class="col-lg-2  col-md-2 col-sm-4 col-xs-6 f-col">
                     <h3><?= lang('categories') ?></h3>
                     <?php if (!empty($footerCategories)) { ?>
                         <ul>
                             <?php foreach ($footerCategories as $key => $categorie) { ?>
-                                <li><a href="javascript:void(0);" data-categorie-id="<?= $key ?>" class="go-category"><?= $categorie ?></a></li>
+                                <li><a href="javascript:void(0);" data-categorie-id="<?= $key ?>" class="go-category"><?= htmlspecialchars($categorie, ENT_QUOTES, 'UTF-8') ?></a></li>
                             <?php } ?>
                         </ul>
                     <?php } else { ?>
                         <p><?= lang('no_categories') ?></p>
                     <?php } ?>
diff --git a/application/views/templates/redlabel/home.php b/application/views/templates/redlabel/home.php
index f8759d63..ec9e485d 100755
--- a/application/views/templates/redlabel/home.php
+++ b/application/views/templates/redlabel/home.php
@@ -102,11 +102,11 @@ if (count($sliderProducts) > 0) {
                                         <i class="fa fa-chevron-right" aria-hidden="true"></i>
                                     <?php } else { ?>
                                         <i class="fa fa-circle-o" aria-hidden="true"></i>
                                     <?php } ?>
                                     <a href="javascript:void(0);" data-categorie-id="<?= $page['id'] ?>" class="go-category left-side <?= isset($_GET['category']) && $_GET['category'] == $page['id'] ? 'selected' : '' ?>">
-                                        <?= $page['name'] ?>
+                                        <?= htmlspecialchars($page['name'], ENT_QUOTES, 'UTF-8') ?>
                                     </a>
                                     <?php
                                     if ($children === true) {
                                         loop_tree($page['children'], true);
                                     } else {
diff --git a/application/views/templates/redlabel/vendor.php b/application/views/templates/redlabel/vendor.php
index 90bd9798..1db1b3e6 100644
--- a/application/views/templates/redlabel/vendor.php
+++ b/application/views/templates/redlabel/vendor.php
@@ -36,11 +36,11 @@ defined('BASEPATH') OR exit('No direct script access allowed');
                                         <i class="fa fa-chevron-right" aria-hidden="true"></i>
                                     <?php } else { ?>
                                         <i class="fa fa-circle-o" aria-hidden="true"></i>
                                     <?php } ?>
                                     <a href="javascript:void(0);" data-categorie-id="<?= $page['id'] ?>" class="go-category left-side <?= isset($_GET['category']) && $_GET['category'] == $page['id'] ? 'selected' : '' ?>">
-                                        <?= $page['name'] ?>
+                                        <?= htmlspecialchars($page['name'], ENT_QUOTES, 'UTF-8') ?>
                                     </a>
                                     <?php
                                     if ($children === true) {
                                         loop_tree($page['children'], true);
                                     } else {

Vulnerable code:                                 <input class="form-control" placeholder="Product Title" type="text" value="<?= isset($_GET['search_title']) ? $_GET['search_title'] : '' ?>" name="search_title">
                        <td><?= $catName ?></td>
                                <div> <?= $sub ?> </div>
                                        $aa .= '[' . $ff['abbr'] . ']' . $ff['name'] . '/';
                    $aa .= '[' . $ff['abbr'] . ']' . $ff['name'] . '/';
                        <td><?= isset($vendor->name) ? $vendor->name : 'Vendor name is empty' ?></td>
                                    $product = unserialize($order['products']);
                                <span><?= $categorie['name'] ?></span>
                                <span><?= $categorie['name'] ?></span>
                                <li><a href="javascript:void(0);" data-categorie-id="<?= $key ?>" class="go-category"><?= $categorie ?></a></li>
                                                        <a href="javascript:void(0);" data-categorie-id="<?= $nav_category['id'] ?>" class="go-category <?= $children == true ? 'mega-title' : '' ?>"><?= $nav_category['name'] ?></a>
                                            <?= $page['name'] ?>
                                        <?= $page['name'] ?>
                                <li><a href="javascript:void(0);" data-categorie-id="<?= $key ?>" class="go-category"><?= $categorie ?></a></li>
                                        <?= $page['name'] ?>
                                        <?= $page['name'] ?>
Fixed code:                                 <input class="form-control" placeholder="Product Title" type="text" value="<?= isset($_GET['search_title']) ? htmlspecialchars($_GET['search_title'], ENT_QUOTES, 'UTF-8') : '' ?>" name="search_title">
                        <td><?= htmlspecialchars($catName, ENT_QUOTES, 'UTF-8') ?></td>
                                <div> <?= htmlspecialchars($sub, ENT_QUOTES, 'UTF-8') ?> </div>
                                        $aa .= '[' . $ff['abbr'] . ']' . htmlspecialchars($ff['name'], ENT_QUOTES, 'UTF-8') . '/';
                    $aa .= '[' . $ff['abbr'] . ']' . htmlspecialchars($ff['name'], ENT_QUOTES, 'UTF-8') . '/';
                        <td><?= isset($vendor->name) ? htmlspecialchars($vendor->name, ENT_QUOTES, 'UTF-8') : 'Vendor name is empty' ?></td>
                                    $product = unserialize($order['products'], ["allowed_classes" => false]);
                                <span><?= htmlspecialchars($categorie['name'], ENT_QUOTES, 'UTF-8') ?></span>
                                <span><?= htmlspecialchars($categorie['name'], ENT_QUOTES, 'UTF-8') ?></span>
                                <li><a href="javascript:void(0);" data-categorie-id="<?= $key ?>" class="go-category"><?= htmlspecialchars($categorie, ENT_QUOTES, 'UTF-8') ?></a></li>
                                                        <a href="javascript:void(0);" data-categorie-id="<?= $nav_category['id'] ?>" class="go-category <?= $children == true ? 'mega-title' : '' ?>"><?= htmlspecialchars($nav_category['name'], ENT_QUOTES, 'UTF-8') ?></a>
                                            <?= htmlspecialchars($page['name'], ENT_QUOTES, 'UTF-8') ?>
                                        <?= htmlspecialchars($page['name'], ENT_QUOTES, 'UTF-8') ?>
                                <li><a href="javascript:void(0);" data-categorie-id="<?= $key ?>" class="go-category"><?= htmlspecialchars($categorie, ENT_QUOTES, 'UTF-8') ?></a></li>
                                        <?= htmlspecialchars($page['name'], ENT_QUOTES, 'UTF-8') ?>
                                        <?= htmlspecialchars($page['name'], ENT_QUOTES, 'UTF-8') ?>